JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard

Description JupyterLab 4.5.0 enabled copying and pasing cells through the system clipboard. The paste path parses clipboard text as cell JSON and inserts the cells without clearing metadata.trusted, so a payload can declare its own output as trusted. JupyterLab does not sanitize a trusted output...

CVE-2026-39987

⚠️ CVE-2026-39987 — Неаутентифицированная оболочка в marimo 0.23.0 Реактивный инструмент для Python-ноутбуков предоставил атакующим полную оболочку одним WebSocket-запросом. 📌 Обзор CVE-2026-39987 — это критическая RCE-уязвимость без аутентификации в marimo — популярном open-source реактивном...

CitrixNetscalerAnalysis

Carnet d'analyse Citrix Un carnet Jupyter pour aider à automatiser une partie de l'analyse forensique liée aux hôtes Citrix Netscaler compromis via CVE-2019-19781. Pour obtenir de l'aide sur la récupération des artefacts à examiner, consultez ce script de triage Citrix. Toutes les notes/suggestio...

SUSE CVE-2026-102831

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.5.0 until 4.5.11 and 4.6.4, from Notebook 7.5.0 until 7.6.3, and from JupyterLite Core 0.7.0 until 0.8.4, the system clipboard cell-paste path accepts...

CVE-2025-63848

CVE-2025-63848 swish-prolog cve Уязвимость хранимого межсайтового скриптинга XSS в SWISH prolog до версии 2.2.0, позволяющая злоумышленникам выполнять произвольный код через специально созданную веб-IDE notebook. Воздействие Захват учетной записи одним кликом. Устранение Обновите до последней...

Linux Distros Unpatched Vulnerability : CVE-2026-102831

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.5.0 until 4.5....

Cross-site Scripting (XSS)

Overview @jupyterlab/apputils is a JupyterLab - Application Utilities Affected versions of this package are vulnerable to Cross-site Scripting XSS via the notebook paste action in packages/notebook/src/actions.tsx, which does not validate whether clipboard data originated from within the...

CVE-2026-102831

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.5.0 until 4.5.11 and 4.6.4, from Notebook 7.5.0 until 7.6.3, and from JupyterLite Core 0.7.0 until 0.8.4, the system clipboard cell-paste path accepts...

DEBIAN-CVE-2026-102831

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.5.0 until 4.5.11 and 4.6.4, from Notebook 7.5.0 until 7.6.3, and from JupyterLite Core 0.7.0 until 0.8.4, the system clipboard cell-paste path accepts...

CVE-2026-102831 JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.5.0 until 4.5.11 and 4.6.4, from Notebook 7.5.0 until 7.6.3, and from JupyterLite Core 0.7.0 until 0.8.4, the system clipboard cell-paste path accepts...

CVE-2026-102831

The JupyterLab environment is vulnerable to a Cross-site scripting (XSS) attack due to the system clipboard cell-paste path accepting attacker-controlled cell JSON without clearing the metadata.trusted field. When useSystemClipboardForCells is active and pasteCodeCellsWithoutOutput is disabled, a...

CVE-2026-102831 JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.5.0 until 4.5.11 and 4.6.4, from Notebook 7.5.0 until 7.6.3, and from JupyterLite Core 0.7.0 until 0.8.4, the system clipboard cell-paste path accepts...

CVE-2025-40536-Analysis

CVE-2025-40536-Analysis victoriaalicex.github.io linearregressiontaxi.ipynb linearregressiontaxi.ipynb...

CVE-2026-39987-marimo-rce

CVE-2026-39987 - Marimo Pre-Auth RCE Exécution de code à distance non authentifiée dans Marimo via le terminal WebSocket 📌 Aperçu CVE-2026-39987 est une vulnérabilité critique d'exécution de code à distance sans authentification affectant les versions de Marimo antérieures à 0.23.0. Le point de...

CVE-2026-102831: Improper Neutralization of Input During Web Page Generation

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.5.0 until 4.5.11 and 4.6.4, from Notebook 7.5.0 until 7.6.3, and from JupyterLite Core 0.7.0 until 0.8.4, the system clipboard cell-paste path accepts...

CVE-2024-23997

YANA Notebook PoC Une preuve de concept pour la vulnérabilité CVE-2024-23997. 1. Aperçu de la vulnérabilité : Sujet de la vulnérabilité : Exécution de code locale via XSS Version vulnérable : = 1.0.16 Type d'attaque : Exécution de code à distance Vecteurs d'attaque : Pour exploiter la...

CVE-2026-77987

A server-side request forgery SSRF vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer validated the scheme and host of a user-supplied URL but did not validate the port, allowing requests to be directed to internal services listening on other port...

CVE-2026-77987 GitHub Enterprise Server notebook viewer vulnerable to Server-side request forgery

A server-side request forgery SSRF vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer validated the scheme and host of a user-supplied URL but did not validate the port, allowing requests to be directed to internal services listening on other port...

CVE-2026-77987 GitHub Enterprise Server notebook viewer vulnerable to Server-side request forgery

A server-side request forgery SSRF vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer validated the scheme and host of a user-supplied URL but did not validate the port, allowing requests to be directed to internal services listening on other port...

EUVD-2026-84872

A server-side request forgery SSRF vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer validated the scheme and host of a user-supplied URL but did not validate the port, allowing requests to be directed to internal services listening on other port...