8.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-42557

CVE-2026-42557: jupyterlab: Command linker attributes in HTML enable one-click command execution from untrusted content

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.7, JupyterLab's HTML sanitizer allowlists data-commandlinker-command and data-commandlinker-args on button elements, while CommandLinker listens for all click events on document.body and executes the named command without checking whether the element came from trusted JupyterLab UI. A notebook with a pre-saved HTML cell output containing a deceptive button can trigger arbitrary JupyterLab commands - including arbitrary code execution - on a single user click, without any code being submitted for execution by the user. This vulnerability is fixed in 4.5.7.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-42557

CVE-2026-42557:

8.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
jupyterlab	pip	<= 4.5.6	4.5.7
notebook	pip	>= 7.0.0, <= 7.5.5	7.5.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability stems from a lack of trust validation in JupyterLab's command execution mechanism. The CommandLinker feature was designed to allow HTML elements, like buttons, to trigger JupyterLab commands. However, it did so indiscriminately for any element in the DOM, including untrusted content rendered from notebook outputs.

The analysis of the patch reveals two key functions involved. The primary vulnerable function is CommandLinker._evtClick in packages/apputils/src/commandlinker.ts. This function is the event handler that listens for clicks and executes commands. Before the patch, it performed no checks to determine if the clicked element was from a trusted part of the UI or from potentially malicious user-provided output.

Aiding this vulnerability was the Sanitizer.sanitize function in packages/apputils/src/sanitizer.ts. By default, it allowed the data-commandlinker-* attributes necessary to trigger commands, meaning that even after sanitization, malicious HTML embedded in a notebook could retain its ability to execute commands.

The patch addresses this by introducing a trust boundary system. The CommandLinker._evtClick function was modified to first check if the clicked element resides within a trusted part of the DOM using a new _isTrusted method. If the element is not trusted, JupyterLab now prompts the user with a security warning before executing the command, thus preventing the one-click exploit. The sanitizer was also updated to allow for disabling the command linker attributes entirely as a hardening measure.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.