Cross-site Scripting (XSS)

🗓️ 09 May 2026 05:41:19Reported by Veracode Vulnerability DatabaseType

JupyterLab XSS flaw in sanitized HTML via data commandlinker attributes enables a malicious notebook button to execute commands.

Reporter	Title	Published	Views	Family All 48
ATTACKERKB	CVE-2026-42557	13 May 202615:06	–	attackerkb
AlpineLinux	CVE-2026-42557	13 May 202615:06	–	alpinelinux
Chainguard	CVE-2026-42557 vulnerabilities	13 May 202619:17	–	cgr
CNNVD	JupyterLab 跨站脚本漏洞	13 May 202600:00	–	cnnvd
CVE	CVE-2026-42557	13 May 202615:06	–	cve
Cvelist	CVE-2026-42557 jupyterlab: Command linker attributes in HTML enable one-click command execution from untrusted content	13 May 202615:06	–	cvelist
Debian CVE	CVE-2026-42557	13 May 202615:06	–	debiancve
Github Security Blog	JupyterLab's command linker attributes in HTML enable one-click command execution from untrusted content	6 May 202621:43	–	github
Tenable Nessus	Jupyterlab Python Library < 4.5.7 (CVE-2026-42557)	8 May 202600:00	–	nessus
Tenable Nessus	Jupyter Notebook Python Library 7.0.0 < 7.5.6 (CVE-2026-42557)	8 May 202600:00	–	nessus

Vulners

Node

jupyter notebookRange7.0.0–7.5.5python

jupyterlab jupyterlabRange0.0.1–4.5.6python

Source	Link
github	www.github.com/jupyterlab/jupyterlab/commit/5d9cb8c634e081028ea6df4dd7149a1b1a84ec56
github	www.github.com/jupyterlab/jupyterlab/commit/c5f522db11d0d20a2be5887186952d6b7144b6b6
jupyterlab	www.jupyterlab.readthedocs.io/en/latest/user/commands.html
security	www.security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42557.json
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
access	www.access.redhat.com/security/cve/CVE-2026-42557
github	www.github.com/advisories/GHSA-mqcg-5x36-vfcg
github	www.github.com/jupyterlab/jupyterlab/security/advisories/GHSA-mqcg-5x36-vfcg

04 Jul 2026 12:00Current

6.4Medium risk

Vulners AI Score6.4

CVSS 3.18.8 - 9.6

CVSS 48.6

EPSS0.00386

SSVC