Threats tagged 'brew-jupyterlab-cve-2026-44897'

JupyterLab's Mistune HTMLRenderer.heading() method improperly handles the id attribute by inserting it directly into the HTML without escaping. When a custom heading_id callback returns user-controlled heading text containing double quotes, this allows injection of arbitrary HTML attributes, enabling cross-site scripting (XSS). The default TOC hook uses safe auto-generated IDs, but common usage involves deriving IDs from heading text, which is vulnerable. This flaw is fixed in JupyterLab version 4.5.7_1.