8.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-40171

CVE-2026-40171: Jupyter Notebook and JupyterLab token theft via stored XSS in help command linker

In Jupyter Notebook versions 7.0.0 through 7.5.5, JupyterLab versions 4.5.6 and earlier, and the corresponding @jupyter-notebook/help-extension and @jupyterlab/help-extension packages before 7.5.6 and 4.5.7, a stored cross-site scripting issue in the help command linker can be chained with attacker-controlled notebook content to steal authentication tokens with a single click.

An attacker can craft a malicious notebook file containing elements that appear indistinguishable from legitimate controls and trigger execution when a user interacts with them. Successful exploitation allows theft of the user's authentication token and complete takeover of the Jupyter session through the REST API, including reading files, creating or modifying files, accessing kernels to execute arbitrary code, and creating terminals for shell access. This issue has been fixed in Notebook 7.5.6, JupyterLab 4.5.7, @jupyter-notebook/help-extension 7.5.6, and @jupyterlab/help-extension 4.5.7. As a workaround, disable the affected help extensions or set allowCommandLinker to false in the sanitizer configuration.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-40171

CVE-2026-40171:

8.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@jupyter-notebook/help-extension	npm	>= 7.0.0, <= 7.5.5	7.5.6
notebook	pip	>= 7.0.0, <= 7.5.5	7.5.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) issue in Jupyter Notebook, identified as GHSA-rch3-82jr-f9w9. The root cause is in the help:open command, located in the @jupyter-notebook/help-extension. The execute function of this command would take a URL from its arguments and open it in a new window without any validation. An attacker could craft a malicious notebook containing a command link that invokes help:open with a javascript: URL. When a user interacts with this link, the malicious script executes, leading to token theft and account takeover.

The analysis of the patches between the vulnerable version 7.5.5 and the patched version 7.5.6 of jupyter/notebook reveals two key changes. The primary fix is in packages/help-extension/src/index.tsx, where a new function isUrlSafe is introduced to validate the protocol of the URL before it is opened. This directly mitigates the XSS vulnerability in the help:open command.

A secondary, but important, change was made in packages/application-extension/src/index.ts within the rendermime plugin. The linkHandler was modified to no longer use app.commandLinker.connectNode, which was the mechanism abused to create the malicious command links. The new implementation uses a standard addEventListener and a trustHandler, providing a more secure way of handling links in rendered output. This change hardens the application against similar attacks in the future.

Vulnerable functions

open.execute

packages/help-extension/src/index.tsx

The `execute` function for the `help:open` command in the help extension was vulnerable to Cross-Site Scripting (XSS). It accepted a URL via its arguments and opened it using `window.open()` without proper validation. An attacker could create a malicious notebook with a command link that executes `help:open` with a `javascript:` URL. When a user clicked this link, the malicious script would execute in their browser, allowing the attacker to steal authentication tokens and take over the user's account.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.