Remote Code Execution Vulnerability in JupyterLab Desktop Application
CVE-2026-102530

9.4CRITICAL

Key Information:

Vendor

Jupyterlab

Status
Jupyterlab-desktop
Vendor
CVE Published:
6 November 2026

What is CVE-2026-102530?

JupyterLab Desktop, the cross-platform desktop application for JupyterLab, had a serious vulnerability before version 4.6.2-1. The application failed to properly encode remote-server URLs in the server-selection dialog and Welcome view, enabling an attacker to exploit this by tricking a user into submitting a malicious URL. This could lead to unauthorized JavaScript execution in the Welcome renderer, leveraging the application's privileged IPC bridge to execute arbitrary code within the user’s context. Additionally, the Welcome view also inadequately rendered RSS news-feed titles, allowing for further exploitation if an attacker controlled the Jupyter Blog feed content. All supported platforms were affected, requiring prompt action to upgrade to version 4.6.2-1 to mitigate the risks.

Affected Version(s)

jupyterlab-desktop < 4.6.2-1

References

https://github.com/jupyterlab/jupyterlab-desktop/security...
x_refsource_CONFIRM
https://github.com/jupyterlab/jupyterlab-desktop/commit/f...
x_refsource_MISC
https://github.com/jupyterlab/jupyterlab-desktop/releases...
x_refsource_MISC

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.