JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard

Description JupyterLab 4.5.0 enabled copying and pasing cells through the system clipboard. The paste path parses clipboard text as cell JSON and inserts the cells without clearing metadata.trusted, so a payload can declare its own output as trusted. JupyterLab does not sanitize a trusted output...

CVE-2026-39987

⚠️ CVE-2026-39987 — marimo 0.23.0에서 인증되지 않은 셸 반응형 Python 노트북 도구로 인해 공격자가 단일 WebSocket 요청으로 전체 셸을 얻을 수 있었습니다. 📌 개요 CVE-2026-39987 은 marimo 현대적인 Jupyter 대안에서 발견된 중대한 인증 전 RCE 취약점입니다. 영향을 받는 버전 : 공식 확인된 모든 버전 0.23.0 CVSS 점수 : 9.3 치명적 유형 : /terminal/ws WebSocket 엔드포인트에 대한 인증 부재 영향 : 인증되지 않은 공격자가 전체 대화...

CitrixNetscalerAnalysis

Citrix 分析笔记本 一个 Jupyter 笔记本，用于自动执行与通过 CVE-2019-19781 被攻陷的 Citrix Netscaler 主机相关的部分取证分析。 关于检索要检查的工件，请参阅 此 Citrix 分类脚本。 欢迎所有注释/建议。请随时提交拉取请求或问题。 免责声明：并非旨在成为万能解决方案，只是帮助您入门。 功能 如果可用，当前处理以下日志和载荷 XML： HTTPAccess HTTPError Cron Bash Notice Sh 日志解压缩 将日志解析为 pandas DataFrames，以便进一步分析（如果需要） 搜索日志中与攻陷相关的常见 IOC...

SUSE CVE-2026-102831

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.5.0 until 4.5.11 and 4.6.4, from Notebook 7.5.0 until 7.6.3, and from JupyterLite Core 0.7.0 until 0.8.4, the system clipboard cell-paste path accepts...

CVE-2025-63848

CVE-2025-63848 swish-prolog cve SWISH Prolog 2.2.0 이하 버전에서 발견된 저장형 교차 사이트 스크립팅XSS 취약점으로, 공격자가 조작된 웹 IDE 노트북을 통해 임의 코드를 실행할 수 있습니다. 영향 원클릭 계정 탈취. 완화 방법 최신 버전으로 업그레이드하여 ATO를 완화하세요. https://github.com/SWI-Prolog/swish/commit/4fb6acb97bedf993ec406a2ef324eeb2a16c49e3...

Linux Distros Unpatched Vulnerability : CVE-2026-102831

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.5.0 until 4.5....

Cross-site Scripting (XSS)

Overview @jupyterlab/apputils is a JupyterLab - Application Utilities Affected versions of this package are vulnerable to Cross-site Scripting XSS via the notebook paste action in packages/notebook/src/actions.tsx, which does not validate whether clipboard data originated from within the...

CVE-2026-102831

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.5.0 until 4.5.11 and 4.6.4, from Notebook 7.5.0 until 7.6.3, and from JupyterLite Core 0.7.0 until 0.8.4, the system clipboard cell-paste path accepts...

DEBIAN-CVE-2026-102831

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.5.0 until 4.5.11 and 4.6.4, from Notebook 7.5.0 until 7.6.3, and from JupyterLite Core 0.7.0 until 0.8.4, the system clipboard cell-paste path accepts...

CVE-2026-102831

The JupyterLab environment is vulnerable to a Cross-site scripting (XSS) attack due to the system clipboard cell-paste path accepting attacker-controlled cell JSON without clearing the metadata.trusted field. When useSystemClipboardForCells is active and pasteCodeCellsWithoutOutput is disabled, a...

CVE-2026-102831 JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.5.0 until 4.5.11 and 4.6.4, from Notebook 7.5.0 until 7.6.3, and from JupyterLite Core 0.7.0 until 0.8.4, the system clipboard cell-paste path accepts...

CVE-2026-102831 JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.5.0 until 4.5.11 and 4.6.4, from Notebook 7.5.0 until 7.6.3, and from JupyterLite Core 0.7.0 until 0.8.4, the system clipboard cell-paste path accepts...

CVE-2025-40536-Analysis

CVE-2025-40536-Analysis victoriaalicex.github.io linearregressiontaxi.ipynb linearregressiontaxi.ipynb...

CVE-2026-39987-marimo-rce

CVE-2026-39987 - Marimo Pre-Auth RCE Unauthenticated Remote Code Execution in Marimo via WebSocket Terminal 📌 개요 CVE-2026-39987 은 Marimo 0.23.0 이전 버전에 영향을 미치는 치명적인 사전 인증 원격 코드 실행 취약점입니다. /terminal/ws WebSocket 엔드포인트는 인증을 완전히 우회하여, 인증되지 않은 모든 공격자가 Marimo 프로세스일반적으로 Docker 환경에서는 root의 권한으로 완전한 대화형 P...

CVE-2026-102831: Improper Neutralization of Input During Web Page Generation

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.5.0 until 4.5.11 and 4.6.4, from Notebook 7.5.0 until 7.6.3, and from JupyterLite Core 0.7.0 until 0.8.4, the system clipboard cell-paste path accepts...

CVE-2024-23997

YANA Notebook PoC CVE-2024-23997 취약점에 대한 개념 증명Proof-of-Concept입니다. 1. 취약점 개요: 취약점 대상: XSS를 통한 로컬 코드 실행 취약점 버전: = 1.0.16 공격 유형: 원격 코드 실행 공격 벡터: 취약점을 악용하려면 Electron 메인 창을 사용하여 HTTP 패킷을 가로채야 합니다. 다음으로, 가로챈 HTML에 악성 스크립트를 주입해야 합니다. Electron이 Yana 노트북의 메인 창을 만들 때 스크립트가 실행되고 OS 명령을 실행할 수 있습니다. 프로그램이 관리...

CVE-2026-77987

A server-side request forgery SSRF vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer validated the scheme and host of a user-supplied URL but did not validate the port, allowing requests to be directed to internal services listening on other port...

CVE-2026-77987 GitHub Enterprise Server notebook viewer vulnerable to Server-side request forgery

A server-side request forgery SSRF vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer validated the scheme and host of a user-supplied URL but did not validate the port, allowing requests to be directed to internal services listening on other port...

CVE-2026-77987 GitHub Enterprise Server notebook viewer vulnerable to Server-side request forgery

A server-side request forgery SSRF vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer validated the scheme and host of a user-supplied URL but did not validate the port, allowing requests to be directed to internal services listening on other port...

EUVD-2026-84872

A server-side request forgery SSRF vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer validated the scheme and host of a user-supplied URL but did not validate the port, allowing requests to be directed to internal services listening on other port...