CVE-2026-102831: JupyterLab Cross-Site Scripting (XSS) Vulnerability via Pasted Notebook Cells
Summary
CVE-2026-102831: Description JupyterLab 4.5.0 enabled copying and pasing cells through the system clipboard. Affects jupyterlab across 2 version ranges.
>= 4.5.0, < 4.5.11
>= 4.6.0, < 4.6.4
Fixed in 4.5.11 or 4.6.4, depending on the release line you run. How to fix ↓
Also tracked for
- jupyterlite · PyPI
- jupyterlite-core · PyPI
- notebook · PyPI
The same CVE-2026-102831 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
JupyterLab is an open-source web-based interactive development environment for Jupyter notebooks, allowing users to create and share documents that contain live code, equations, visualizations, and narrative text. It is widely used in data science and machine learning for its powerful features and flexibility. However, a recent vulnerability has been identified in versions 4.5.0 to 4.6.3, where the application allows for the pasting of notebook cells from the system clipboard without proper sanitization, leading to potential cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability arises from JupyterLab's handling of clipboard data when pasting cells. When users paste cells that contain JavaScript code, the application does not clear the 'metadata.trusted' flag, allowing the pasted content to be treated as trusted. This means that any malicious script included in the pasted cell can be executed in the context of the user's session, potentially allowing attackers to access sensitive information or perform unauthorized actions on the Jupyter Server. The vulnerability affects users who have enabled the 'useSystemClipboardForCells' setting and paste cells with outputs.
How To Fix
Latest published version: 4.6.4 as of 22 Oct 2026
pip install --upgrade "jupyterlab==4.6.4"The newest release already contains this fix.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 4.5.0, < 4.5.114.5.11pip install --upgrade "jupyterlab==4.5.11"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
For users on JupyterLab versions 4.5.2 and later, a temporary workaround is to disable the use of the system clipboard for cells by modifying the settings. This can be done by adding the following configuration to the settings:
{
"@jupyterlab/notebook-extension:tracker": { "useSystemClipboardForCells": false
}
}
This setting ensures that cell copy and paste operations use JupyterLab's in-application clipboard, which does not leave the page and is safer. Additionally, users can paste cells without their outputs by setting:
{
"@jupyterlab/notebook-extension:tracker": { "pasteCodeCellsWithoutOutput": true
}
}
This will prevent scripts from running but will discard outputs on every paste.
Conclusion
The identified vulnerability in JupyterLab poses a significant risk due to its potential for cross-site scripting attacks through pasted notebook cells. Users are strongly encouraged to update to the latest patched versions to secure their applications. Additionally, implementing the suggested workarounds can help mitigate the risk until an update can be performed.
See every vulnerability recorded for jupyterlab →
FAQ
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
JupyterLab versions 4.5.0 to 4.6.3 are affected by this vulnerability.
Cross-site scripting (XSS) is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users, potentially compromising their data and session.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you cannot update JupyterLab immediately, consider applying the provided workarounds to mitigate the risk until you can perform the update.
References
Related vulnerabilities
Recent vulnerabilities recorded for jupyterlab.
