GHSA-rch3-82jr-f9w9: Jupyter Notebook Vulnerable to Authentication Token Theft via CommandLinker XSS

Summary

A stored XSS flaw in Jupyter Notebook lets attackers steal authentication tokens when users open malicious notebook files and click elements disguised as legitimate controls. The stolen token enables full account takeover through the Jupyter REST API, including reading and modifying files, accessing running kernels, and creating terminals.

Mitigation

Jupyter Notebook 7.5.6 and JupyterLab 4.5.7 include patches for this vulnerability. Workarounds: disable the help extension with `jupyter labextension disable @jupyter-notebook/help-extension` and `jupyter labextension disable @jupyterlab/help-extension`. The patched versions also allow disabling the command linker via `overrides.json` by setting `"@jupyterlab/apputils-extension:sanitizer": {"allowCommandLinker": false}`.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• jupyterlabPyPINo LLM dependency detected · 16 tracked dependents
• notebookPyPINo LLM dependency detected · 6 tracked dependents

Related items

• HighCVE-2026-65142: NVIDIA Model-Optimizer untrusted data deserializationSame vendor · NVD/CVE Database
• HighGHSA-g28h-2cmm-rj9x: langchain-nvidia-ai-endpoints has local file disclosure through VLM image inputsSame vendor · GitHub Advisory Database
• HighCVE-2026-47625: NVIDIA Triton Inference Server for Linux missing authorization flawSame vendor · NVD/CVE Database
• HighCVE-2026-16497: NVIDIA Triton Inference Server for Linux excessive iteration denial of serviceSame vendor · NVD/CVE Database
• MediumCVE-2026-47630: NVIDIA Triton Inference Server for Linux absolute path traversalSame vendor · NVD/CVE Database