Trust Management Flaw in JupyterLab by Project Jupyter
CVE-2026-102832
What is CVE-2026-102832?
A significant flaw in JupyterLab can lead to improper trust management during user interactions with Markdown viewers and notebooks. When using certain command-link handlers in versions 4.5.7 to 4.5.11 and 4.6.4, the application fails to retain the correct document context when a user is prompted to trust content. If a different document becomes active while prompts are open, trusting the second document inadvertently grants trust to content that should remain untrusted. This can allow command buttons in the misidentified document to execute without proper security prompts, and it marks all cells in a notebook as trusted while saving potentially unsafe changes. This behavior has been observed in other applications relying on JupyterLab, making it critical to update to versions 4.5.11 or 4.6.4 to ensure safety.
Affected Version(s)
jupyterlab >= 4.5.7, < 4.5.11 < 4.5.7, 4.5.11
jupyterlab >= 4.6.0, < 4.6.4 < 4.6.0, 4.6.4
jupyterlite-core >= 0.7.5, < 0.8.4