CVE-2026-102832
JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked
Published Oct 13, 2026 · corrected/updated Oct 15, 2026 · jupyterlab jupyterlab · evidence confidence high
## Description A Markdown file or a notebook output can carry a button that runs a JupyterLab command. Since 4.5.7 the first click on such a button opens a prompt naming the command, with Cancel, Run Once and Trust. Choosing Trust runs the command and marks the document trusted, so its later buttons run without a prompt. Which document gets marked is decided when the user answers, not when they click. Both trust commands read whichever document is current at that moment: uses , and uses the equivalent lookup. If another document becomes current while the prompt is open, that document is the one marked trusted, and the one the user was looking at stays untrusted. Users are affected if all of the following are true: - they run JupyterLab 4.5.7 through 4.6.3, or an application that bundles it such as Notebook 7.5+; - they open a Markdown file or notebook from someone else and click a button in it; - they answer Trust rather than Cancel or Run Once; and - a second document becomes the current one while the prompt is open, for example through a workspace restoring at startup, an extension activating a widget, or a command that opens a file ### Impact The user loses control over which document they trusted. Every button in the document that was (incorrectly) marked as trusted runs from then on without a prompt, so if that document also came from an untrusted source, its buttons fire on a single click with no confirmation. That is the state the prompt was added to prevent, in [GHSA-mqcg-5x36-vfcg](https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-mqcg-5x36-vfcg). The command that ran had the user's consent, because the prompt named it and they pressed Trust. The document they were reading stays untrusted, so it prompts again on the next click. #### Notebooks are written to disk When the document marked is a notebook, the effect outlives the browser session. marks every cell trusted and then saves the file, which results in the server signing it, so the note
Grounded briefings
Catalog interpretations for three audiences. Each brief cites ingested metadata and the original advisories below. They are not independent research and they do not invent exploit steps.
Executive
CVE-2026-102832 is a medium public vulnerability record for jupyterlab jupyterlab. It is not currently listed in the CISA Known Exploited catalog. Check the linked vendor or CERT advisories for patch status. This summary is a catalog interpretation of the ingested metadata and cites the original advisories below.
System administrator
Identify whether jupyterlab jupyterlab is in your estate, then compare installed versions with the affected ranges. Affected packages or ranges on record: jupyterlab (4.5.7 → 4.5.11); jupyterlab (4.6.0 → 4.6.4); jupyterlite-core (0.7.5 → 0.8.4); notebook (7.5.6 → 7.6.3). Check the linked vendor or CERT advisories for patch status. Prefer the vendor or distribution advisory linked in Sources before changing production systems. This is a catalog interpretation, not a runbook.
Security analyst
Signals on file: CVSS 4.2, EPSS 0.1%. It is not currently listed in the CISA Known Exploited catalog. Weakness classes: CWE-367, CWE-863. Sources contributing to this record: cve_org, epss, github, gitlab. Public exploit references, when present, are outbound links only and are not proof of active exploitation. This is a catalog interpretation of stored metadata.
Exploitation and remediation
Exploitation evidence
Not listed as known exploited in CISA KEV. Not in the CISA KEV catalog.
Patch and remediation
No required-action text is stored yet. Use the vendor or CERT links in Sources for patch availability.
Safe detection guidance
Compare installed versions with the affected ranges below and verify the advisory from the original publisher. This site stores metadata and outbound links only; it does not ship exploit code or proof-of-concept payloads.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 15, 2026 · GitHub Advisory Database
Detected
## Description A Markdown file or a notebook output can carry a button that runs a JupyterLab command. Since 4.5.7 the first click on such a button opens a prompt naming the command, with Cancel, Run Once and Trust. Choosing Trust runs the command and marks the document trusted, so its later buttons run without a prompt. Which document gets marked is decided when the user answers, not when they cl
Oct 15, 2026 · GitHub Advisory Database
Fix available
jupyterlab fixed in 4.6.4; jupyterlab fixed in 4.5.11; notebook fixed in 7.6.3; jupyterlite-core fixed in 0.8.4
Oct 15, 2026 · GitHub Advisory Database
Fix available
jupyterlab fixed in 4.6.4
Oct 15, 2026 · GitHub Advisory Database
Fix available
jupyterlab fixed in 4.5.11
Oct 15, 2026 · GitHub Advisory Database
Fix available
notebook fixed in 7.6.3
Oct 15, 2026 · GitHub Advisory Database
Fix available
jupyterlite-core fixed in 0.8.4
Oct 15, 2026 · GitHub Advisory Database
Updated
## Description A Markdown file or a notebook output can carry a button that runs a JupyterLab command. Since 4.5.7 the first click on such a button opens a prompt naming the command, with Cancel, Run Once and Trust. Choosing Trust runs the command and marks the document trusted, so its later buttons run without a prompt. Which document gets marked is decided when the user answers, not when they cl
Affected
- PyPI jupyterlab4.5.7 → 4.5.11
- PyPI jupyterlab4.6.0 → 4.6.4
- PyPI jupyterlite-core0.7.5 → 0.8.4
- PyPI notebook7.5.6 → 7.6.3
- pip jupyterlab>= 4.5.7, <= 4.5.10
- pip jupyterlab>= 4.6.0, <= 4.6.3
- pip jupyterlite-core>= 0.7.5, <= 0.8.3
- pip notebook>= 7.5.6, <= 7.6.2
- pypi jupyterlabversion unspecified
- pypi jupyterlite-coreversion unspecified
- pypi notebookversion unspecified
- vendor jupyterlab jupyterlabversion unspecified
- vendor jupyterlab jupyterlite-coreversion unspecified
- vendor jupyterlab notebookversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-102832
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.7 until 4.5.11 and 4.6.4, the markdownviewer:trust and notebook:trust command-link handlers use tracker.currentWidget to resolve the current Ma
cve.org - FIRST EPSSExploitation probabilityCVE-2026-102832
30-day exploitation probability 0.1%
first.org - GitHub Advisory DatabasePackage advisoryGHSA-jwrc-gm9j-263p
GitHub Advisory Database record mirrored by OSV.
github.com - GitLab Advisory DatabasePackage advisoryCVE-2026-102832
A Markdown file or a notebook output can carry a button that runs a JupyterLab command. Since 4.5.7 the first click on such a button opens a prompt naming the command, with Cancel, Run Once and Trust. Choosing Trust runs the command and marks the document trusted, so its later buttons run without a prompt. Which document gets marked is decided when the user answers, not when they click. Both …
advisories.gitlab.com - OSV.devPackage advisoryGHSA-jwrc-gm9j-263p
JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked
osv.dev