Remote Code Execution Vulnerability in JupyterLab Desktop by Jupyter

CVE-2026-86044

What is CVE-2026-86044?

JupyterLab Desktop, the cross-platform application for JupyterLab, contains a vulnerability that allows an attacker to execute arbitrary code. Specifically, prior to version 4.6.2-1, the software exposed the getServerInfo function to the renderer without confirming the local Jupyter server's origin. This security flaw enabled attackers to embed malicious links in untrusted notebooks. If a user clicks on such a link, the renderer could navigate to an attacker-controlled site, allowing unauthorized access to server information and tokens. This potentially enables the execution of code with the same privileges as the victim. Users of JupyterLab version 4.4.8 or later are not affected due to improvements in link handling that mitigate this risk.

References