CoreCVE
Back

HIGH

Jupyter Notebook and JupyterLab token theft via stored XSS in help command linker

Published May 6, 2026

Description

In Jupyter Notebook versions 7.0.0 through 7.5.5, JupyterLab versions 4.5.6 and earlier, and the corresponding @jupyter-notebook/help-extension and @jupyterlab/help-extension packages before 7.5.6 and 4.5.7, a stored cross-site scripting issue in the help command linker can be chained with attacker-controlled notebook content to steal authentication tokens with a single click.

An attacker can craft a malicious notebook file containing elements that appear indistinguishable from legitimate controls and trigger execution when a user interacts with them. Successful exploitation allows theft of the user's authentication token and complete takeover of the Jupyter session through the REST API, including reading files, creating or modifying files, accessing kernels to execute arbitrary code, and creating terminals for shell access. This issue has been fixed in Notebook 7.5.6, JupyterLab 4.5.7, @jupyter-notebook/help-extension 7.5.6, and @jupyterlab/help-extension 4.5.7. As a workaround, disable the affected help extensions or set allowCommandLinker to false in the sanitizer configuration.

Affected products

Remediation

Red Hat statement

This is an Important flaw in Jupyter Notebook and JupyterLab, enabling a stored cross-site scripting (XSS) attack. An attacker can craft a malicious notebook that, with a single user click, can steal authentication tokens and fully compromise the Jupyter session, leading to arbitrary code execution and information disclosure. This impacts Red Hat OpenShift AI and Migration Toolkit for Applications.

Red Hat mitigation

To reduce the risk of exploitation, disable the affected help extensions in Jupyter Notebook and JupyterLab, or set the `allowCommandLinker` option to `false` within the sanitizer configuration. Consult the Jupyter documentation for specific instructions on modifying these settings. Disabling these features may affect the availability of certain help functionalities.

Metrics

Weaknesses (2)

CWE-601

Open Redirect

CWE-79

Cross-site Scripting (XSS)

References (7)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner GitHub_M
Published May 6, 2026
Updated May 8, 2026
Reserved Apr 9, 2026
Link CVE-2026-40171
CISA Vulnrichment
Updated May 7, 2026
NVD
Status Awaiting Analysis
Modified Jun 17, 2026
Link CVE-2026-40171
Red Hat
Severity Important
Public date May 6, 2026
Links CVE-2026-40171 - Bugzilla
GHSA-RCH3-82JR-F9W9