Threats tagged 'brew-jupyterlab-cve-2026-102831'

JupyterLab versions 4.5.0 through 4.6.3 contain a cross-site scripting (XSS) vulnerability via the system clipboard paste functionality for notebook cells. The vulnerability arises because pasted cells retain a trusted metadata flag that causes embedded script elements in cell outputs to execute without sanitization. This allows attacker-controlled JavaScript to run in the context of the authenticated user’s JupyterLab session upon pasting. The vulnerability is patched in version 4.6.4 and 4.5.11.