CVE-2026-86044 · Package
NO FIX YET · SEE WHAT TO DO
JupyterLab Desktop exposes a bridge that returns the local Jupyter server URL and auth token to any page the window navigates to. A crafted MathJax link in an untrusted notebook, once clicked, lets an attacker's site read that token and run arbitrary code as the user.
first public Jul 24, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running JupyterLab Desktop or a local managed JupyterLab session on a workstation with JupyterLab before 4.4.8 are exposed. A victim must open an untrusted notebook and click a crafted link. Users already on JupyterLab 4.4.8 or later are unaffected per the description.
Not affected if jupyterlab-4.4.8-or-later, no-desktop-app, untrusted-notebooks-never-opened
Who cares data-science, jupyterlab, jupyterlab-desktop, python
4.6.2-1.4.4.8.4.6.2-14.4.8 or later (per the description)JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, JupyterLab Desktop exposed getServerInfo to the renderer without confirming that the current page still had the local Jupyter server origin. In a local managed session using JupyterLab before 4.4.8, an attacker can place a crafted MathJax link in an untrusted notebook. If a victim opens the notebook and clicks the link, the existing renderer navigates to an attacker-controlled site while retaining access to the preload bridge. The site can call getServerInfo to obtain the local server URL and authentication token, then use the Jupyter REST API to create and trust a notebook that executes arbitrary code as the victim. Users whose environment already uses JupyterLab 4.4.8 or later are unaffected because the corrected link handling breaks the first step of the chain. This vulnerability is fixed in 4.6.2-1.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.