Database/AI/ML frameworks & serving
Jupyter Notebook and JupyterLab: stored XSS in the help command linker steals the session token
Impact
A notebook file can embed markup that the help extension's command linker renders without sanitizing, so controls that look legitimate execute attacker JavaScript when clicked. One click gives the attacker the victim's Jupyter authentication token and, through the REST API, the whole session: read and write files, attach to kernels to run arbitrary code, and open terminals for shell access. On a GPU fleet that means a shared notebook - pulled from a colleague, a repo or a dataset bundle - converts into code execution on the GPU node under the notebook user, with access to their data and mounted storage. Affects Notebook 7.0.0-7.5.5 and JupyterLab 4.5.6 and earlier.
Who can reach it
Any user who can place a notebook file where a victim will open it, plus one click by the authenticated victim inside their own Jupyter session. The attacker needs no account on the server; the victim's authenticated session is what is abused.
What to do
Upgrade to Notebook 7.5.6 / JupyterLab 4.5.7 (or help-extension 7.5.6 / 4.5.7) and restart each notebook server - users lose running kernels, so schedule it. Where upgrading now is not possible, disable the help extensions or set allowCommandLinker to false in the sanitizer configuration, which also requires a server restart.
References
Related entries
- mcp-shell: allowlist validates only the first token, so /bin/bash -c runs any commandCVE-2026-55581 · mcp-shell (security.go command allowlist, /bin/bash -c handling)High
- mcp-shell: allowed git binary runs arbitrary commands via a `!` alias, bypassing secure modeCVE-2026-55582 · mcp-shell (security.go shell-metacharacter checks, git alias handling)High
- NVIDIA TensorRT-LLM: untrusted tokenizer loading in KvCacheAwareRouter can execute codeCVE-2026-65119 · NVIDIA TensorRT-LLM (KvCacheAwareRouter tokenizer loading)High
- NVIDIA NeMo Agent Toolkit: SQL injection allows data tampering and disclosureCVE-2026-65151 · NVIDIA NeMo Agent Toolkit (SQL query construction)High
- Eclipse Che: authenticated SSRF in devfile URL fetching leaks the pod service-account tokenCVE-2026-86671 · Eclipse Che (URLFetcher in /api/scm/resolve and /api/factory/resolver)High
- Gradio: CORS origin validation bypassCVE-2024-47084 · GradioHigh
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.