A stored cross-site scripting (XSS) vulnerability in Jupyter Notebook (7.0.0 to 7.5.5) and JupyterLab (up to 4.5.6) allows an attacker to craft malicious notebook content that, when interacted with, can steal the user's authentication token. This token theft enables full session takeover via the REST API, including file access and arbitrary code execution. The issue is fixed in Jupyter Notebook 7.5.6 and JupyterLab 4.5.7. Workarounds include disabling the affected help extensions or setting allowCommandLinker to false.