| Package | Affected versions | Patched versions |
|---|---|---|
| jupyterlab | < 4.5.7 | 4.5.7 |
| notebook | ≥ 7.0.0, < 7.5.6 | 7.5.6 |
| jupyterlab | < 4.5.7 | 4.5.7 |
| notebook | ≥ 7.0.0, < 7.5.6 | 7.5.6 |
JupyterLab's HTML sanitizer allowlists data-commandlinker-command and data-commandlinker-args on button elements, while CommandLinker listens for all click events on document.body and executes the named command without checking whether the element came from trusted JupyterLab UI. A notebook with a pre-saved HTML cell output containing a deceptive button can trigger arbitrary JupyterLab commands - including arbitrary code execution - on a single user click, without any code being submitted for execution by the user.
An attacker who shares a notebook or a Markdown file - via email, GitHub, or a Binder link - can invoke an arbitrary command upon a single click by the victim. The button can be rendered inside the output area and be visually indistinguishable from a legitimate widget. No kernel needs to start; the HTML output is stored in the notebook file and displayed immediately on open.
An attacker convincing the victim to click on a single button or link can:
The arbitrary code execution will be immediately visible to the user; and can be halted by the timely user intervention. The deletion of files can be silent and go unnoticed for some time.
An attacker who convinces the victim to click on multiple buttons in specific order and to grant access to clipboard (or in scenarios where the user already granted keyboard access) can obtain full access to the terminal and execute arbitrary commands in the environment with access scope that might exceed that of available kernels. Only users of Chromium-based browsers are susceptible to this expanded variant of the attack.
The execution of commands in the terminal would be immediately visible to the user.
The impact described above assumes a plain JupyterLab/Notebook installation. In environments with frontend extensions that contribute additional commands the attack surface is increased by the functionality covered by these commands.
JupyterLab 4.5.7
No workarounds are available for end-users.
Downstream applications inheriting from or can effectively disable the by passing option in the initialization options.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site freeJupyterFrontEndJupyterLabCommandLinkercommandLinker: new CommandLinker({ commands: new CommandRegistry() })The patched versions include a toggle to disable the command linker functionality altogether, for example via overrides.json:
{
"@jupyterlab/apputils-extension:sanitizer": {
"allowCommandLinker": false
}
}