JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked (CVE-2026-102832)

JupyterLab versions 4.5.7 through 4.6.3 have a vulnerability where the trust prompt for command links in Markdown files or notebook outputs can incorrectly mark a different document as trusted if the current document changes while the prompt is open. This happens because the trust commands use the document that is current at the time the user responds, not the one containing the clicked button. As a result, a document from an untrusted source may be trusted inadvertently, allowing its command buttons to run without further prompts. For notebooks, this trusted state is saved to disk, persisting across sessions. The vulnerability requires user interaction and conditions such as opening multiple documents and switching focus during the prompt. Patches fixing this issue are included in JupyterLab 4.6.4 and 4.5.11, which ensure the trust applies to the document clicked. Users of dependent applications like Notebook 7.5+ should also update accordingly. Workarounds include disabling the command linker feature or selecting "Run Once" instead of "Trust" to avoid persistent trust.

The vulnerability causes users to lose control over which document they trust when clicking command buttons in Markdown or notebook documents. Trusted documents execute commands without prompting, which can lead to unintended command execution if an untrusted document is mistakenly trusted. For notebooks, the trusted state is saved to disk, making the effect persistent across sessions. This undermines the security measure introduced to prevent untrusted documents from running commands without explicit user consent. The vulnerability requires user interaction and specific conditions such as switching documents during the trust prompt.

A patch is available in JupyterLab versions 4.6.4 and 4.5.11 that fixes the issue by associating the trust prompt with the document clicked rather than the current document at response time. Users should update to these versions or later. Applications bundling JupyterLab, such as Notebook 7.5+, should also update the jupyterlab package accordingly. For environments where immediate update is not possible, disabling the command linker feature via configuration removes the ability to execute frontend commands but impacts functionality. Alternatively, users should choose "Run Once" instead of "Trust" to avoid persistent trust being applied incorrectly.