JupyterLab's command linker attributes in HTML enable one-click command execution from untrusted content (CVE-2026-42557)

JupyterLab's HTML sanitizer allowlists `data-commandlinker-command` and `data-commandlinker-args` attributes on button elements, and the CommandLinker listens for clicks on the document body to execute commands without verifying the source element's trustworthiness. This allows an attacker to embed malicious buttons in notebook outputs or Markdown files that, when clicked by a user, execute arbitrary commands including code execution, file deletion, and resource exhaustion. Multi-click attacks combined with clipboard or keyboard access on Chromium browsers can lead to terminal command execution with potentially broader access. The vulnerability affects JupyterLab versions before 4.5.7 and 4.6.3. The issue is mitigated by updating to patched versions and optionally disabling the CommandLinker functionality via configuration.

An attacker can execute arbitrary code in JupyterLab kernels, delete files causing potential data loss, and launch multiple kernels or terminals to degrade server availability. The attack requires user interaction (click) but no kernel startup is needed to trigger commands. Multi-click attacks on Chromium browsers can escalate to terminal command execution if clipboard or keyboard access is granted. The impact extends with third-party frontend extensions that add commands, increasing the attack surface. The arbitrary code execution is visible to users and can be stopped, but file deletion may go unnoticed. Denial of service can affect standalone multi-tenant deployments more severely than JupyterHub.

A patch is available in JupyterLab version 4.5.7 and later. Users should upgrade to these versions to remediate the vulnerability. No workarounds are available for end-users. Downstream applications can disable the CommandLinker by initializing it with an empty CommandRegistry. Additionally, the patched versions provide a configuration toggle to disable the CommandLinker functionality entirely via the `overrides.json` file by setting `allowCommandLinker` to false. Users should apply these mitigations as appropriate.