1673 matches found
mcpjam-to-root
⚠️ Disclaimer This repository is intended for authorized security research, penetration testing, and educational purposes only. Do not use the techniques described here against systems without explicit authorization. ⚡ MCPJam → Root From MCPJam Inspector RCE to root — CVE-2026-23744, JupyterLab...
gha-lab-0ba60e6456
Integration Testing This folder contains the integration tests of the extension. They are defined using Playwright test runner and Galata helper. The Playwright configuration is defined in playwright.config.js. The JupyterLab server configuration to use for the integration test is defined in...
CVE-2024-39700-PoC
CVE-2024-39700 Proof of Concept Repositories created using this template with test option include update-integration-tests.yml workflow which has an RCE vulnerability. PoC PR: https://github.com/LOURC0D3/CVE-2024-39700-PoC/pull/2 Commit Action Result:...
Linux Distros Unpatched Vulnerability : CVE-2026-102832
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.7 until 4.5.11 and 4.6....
EUVD-2026-98809
JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked...
JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked
Description A Markdown file or a notebook output can carry a button that runs a JupyterLab command. Since 4.5.7 the first click on such a button opens a prompt naming the command, with Cancel, Run Once and Trust. Choosing Trust runs the command and marks the document trusted, so its later buttons...
GHSA-JWRC-GM9J-263P JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked
Description A Markdown file or a notebook output can carry a button that runs a JupyterLab command. Since 4.5.7 the first click on such a button opens a prompt naming the command, with Cancel, Run Once and Trust. Choosing Trust runs the command and marks the document trusted, so its later buttons...
SUSE CVE-2026-102832
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.7 until 4.5.11 and 4.6.4, the markdownviewer:trust and notebook:trust command-link handlers use tracker.currentWidget to resolve the current Markdown viewer or...
BIT-JUPYTERLAB-2026-67338 JupyterLab before 4.5.9 Stored XSS via Extension Manager
JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...
CVE-2026-102832
A flaw was found in JupyterLab. This vulnerability allows an untrusted document to gain trusted status without intended user authorization. When a trust confirmation prompt is displayed, switching the active document causes JupyterLab to grant trust to whichever document is currently focused rath...
Time-of-check Time-of-use (TOCTOU) Race Condition
Overview jupyterlab is a JupyterLab computational environment. Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition via the CommandLinker trust mechanism, where a command-link click triggers a trust dialog and, upon user approval, executes the...
CVE-2026-102832
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.7 until 4.5.11 and 4.6.4, the markdownviewer:trust and notebook:trust command-link handlers use tracker.currentWidget to resolve the current Markdown viewer or...
CVE-2026-102832
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.7 until 4.5.11 and 4.6.4, the markdownviewer:trust and notebook:trust command-link handlers use tracker.currentWidget to resolve the current Markdown viewer or...
UBUNTU-CVE-2026-102832
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.7 until 4.5.11 and 4.6.4, the markdownviewer:trust and notebook:trust command-link handlers use tracker.currentWidget to resolve the current Markdown viewer or...
CVE-2026-102832
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.7 until 4.5.11 and 4.6.4, the markdownviewer:trust and notebook:trust command-link handlers use tracker.currentWidget to resolve the current Markdown viewer or...
CVE-2026-102832 JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.7 until 4.5.11 and 4.6.4, the markdownviewer:trust and notebook:trust command-link handlers use tracker.currentWidget to resolve the current Markdown viewer or...
CVE-2026-102832
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.7 until 4.5.11 and 4.6.4, the markdownviewer:trust and notebook:trust command-link handlers use tracker.currentWidget to resolve the current Markdown viewer or...
CVE-2026-102832 JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.7 until 4.5.11 and 4.6.4, the markdownviewer:trust and notebook:trust command-link handlers use tracker.currentWidget to resolve the current Markdown viewer or...
CVE-2026-102832
The JupyterLab environment (versions 4.5.7 to 4.5.11 and 4.6.4) contains a logic flaw in the markdownviewer:trust and notebook:trust command-link handlers. The root cause is the use of tracker.currentWidget to resolve the target document when a user interacts with a trust prompt, rather than reta...
CVE-2026-102832 JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.7 until 4.5.11 and 4.6.4, the markdownviewer:trust and notebook:trust command-link handlers use tracker.currentWidget to resolve the current Markdown viewer or...