CVE-2026-102831 in JupyterLite Core
Summary
by MITRE • 09/29/2026
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.5.0 until 4.5.11 and 4.6.4, from Notebook 7.5.0 until 7.6.3, and from JupyterLite Core 0.7.0 until 0.8.4, the system clipboard cell-paste path accepts attacker-controlled cell JSON without clearing metadata.trusted. When useSystemClipboardForCells is active and pasteCodeCellsWithoutOutput is disabled, a pasted code cell can mark HTML output as trusted, bypass output sanitization, and execute script in the authenticated JupyterLab origin without executing the cell. Markdown and raw cells are not affected because their output is sanitized. This issue is fixed in JupyterLab 4.5.11 and 4.6.4, Notebook 7.6.3, and JupyterLite Core 0.8.4.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified involves a critical flaw within the clipboard handling mechanisms of several popular Python-based interactive computing environments, specifically affecting versions of JupyterLab between 4.5.0 and 4.5.11 as well as 4.6.0 through 4.6.3, Notebook from 7.5.0 to 7.6.2, and JupyterLite Core from 0.7.0 to 0.8.3. This security issue stems from the system clipboard cell-paste path failing to properly sanitize or reset trust metadata when processing pasted content. In these environments, cells can be marked as trusted or untrusted based on their execution history and source integrity. The flaw allows an attacker-controlled JSON representation of a code cell to bypass standard sanitization protocols by retaining the trusted status in its metadata.trusted field during the paste operation under specific configuration conditions.
The operational impact is significant because it enables cross-origin script execution without requiring the user to explicitly run the malicious code cell. When the environment settings have useSystemClipboardForCells enabled and pasteCodeCellsWithoutOutput disabled, a pasted code cell can inject HTML output that is marked as trusted. This bypasses the usual output sanitization filters designed to prevent arbitrary JavaScript execution from rendered outputs. Consequently, an attacker who can trick a user into pasting malicious content via the clipboard can execute scripts within the authenticated JupyterLab origin. This effectively allows for session hijacking, data exfiltration, or further lateral movement within the connected infrastructure without triggering standard security alerts associated with cell execution events.
This vulnerability is categorized under CWE-94 Improper Control of Generation of Code (Code Injection) and aligns with ATT&CK technique T1059 Command and Scripting Interpreter, specifically regarding the abuse of trusted contexts to execute unauthorized commands. The attack vector relies on social engineering or a compromised clipboard source rather than direct network exploitation, making it particularly insidious in collaborative environments where users frequently share code snippets. It is important to note that markdown and raw cells are not affected by this specific flaw because their output rendering pipelines apply stricter sanitization measures that prevent the execution of embedded scripts regardless of trust metadata status.
Mitigation requires immediate upgrading to patched versions, specifically JupyterLab 4.5.11 or later for the 4.5.x branch, JupyterLab 4.6.4 and above for the 4.6.x series, Notebook version 7.6.3 or newer, and JupyterLite Core 0.8.4 or higher. Administrators should also consider reviewing environment configurations to disable useSystemClipboardForCells if clipboard-based cell manipulation is not strictly required by their workflow, thereby reducing the attack surface. Additionally, enforcing strict output sanitization policies at the server level can provide an additional layer of defense against similar trust bypass attempts in future iterations of these tools.