JupyterLab: saved HTML cell output can run arbitrary JupyterLab commands on one user click

Impact

The sanitizer allowlists data-commandlinker-command and data-commandlinker-args on buttons, and CommandLinker executes the named command for any click on document.body without checking that the element came from trusted JupyterLab UI. A notebook whose stored HTML output contains a deceptive button therefore triggers arbitrary JupyterLab commands - including code execution - the moment a user clicks it, with no cell ever being run. On a shared GPU cluster this turns a notebook file into a delivery mechanism: a shared, downloaded, or cloned notebook opened by another user runs code as that user, in that user's kernel, on whatever GPU node the kernel landed on, with their tokens and mounted dataset shares. Red Hat ships the affected code in OpenShift AI 3.4 workbench images, so multi-tenant notebook platforms inherit it.

Who can reach it

Anyone who can get a notebook file in front of a JupyterLab user - a shared project directory, a git repo, a dataset bundle, or a link to a hosted workbench. No authentication to the server is needed by the attacker, but the victim must open the notebook and click the planted button.

What to do

Upgrade JupyterLab to 4.5.7 and restart the notebook servers; on OpenShift AI apply RHSA-2026:43038 / RHSA-2026:60520 and roll the workbench images so running notebook pods pick up the fix. This is a userspace Python package - no node drain or reboot, but every running single-user server keeps the vulnerable frontend until it is restarted, so plan a workbench restart cycle rather than assuming the package upgrade alone is sufficient.

References

Related entries

• LocalAI (`/models/apply`): Unauthenticated SSRF fetching arbitrary internal URLsCVE-2026-59707 · LocalAI (`/models/apply`)High
• Text Generation Inference (TGI): SSRF in the OpenAI-compatible multimodal chat endpointCVE-2026-63086 · Text Generation Inference (TGI)High
• Vocos: model config can name any importable class, so from_pretrained runs the repo owner's codeCVE-2026-79784 · Vocos (instantiate_class in vocos/pretrained.py)High
• Qdrant (`/logger`): Append to arbitrary files via the logger endpointCVE-2026-25628 · Qdrant (`/logger`)High
• NVIDIA OpenShell Sandbox: path traversal bypasses L7 REST network policy, exposing blocked endpointsCVE-2026-65092 · NVIDIA OpenShell Sandbox for Linux (L7 REST network policy enforcement)High
• Darknet: integer overflow in convolutional layer sizing yields a heap overflow from a crafted .cfgCVE-2026-72852 · hank-ai/darknet convolutional layer (.cfg model definition parsing)High