CVE-2026-102832

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.7 until 4.5.11 and 4.6.4, the markdownviewer:trust and notebook:trust command-link handlers use tracker.currentWidget to resolve the current Markdown viewer or notebook when the user answers rather than retaining the document whose command button was clicked. If another document becomes current while the prompt is open and the user chooses Trust, JupyterLab marks the second document trusted while leaving the clicked document untrusted. Later command buttons in the incorrectly trusted document run without a prompt, and trusting a notebook marks all cells trusted, saves unsaved edits, and persists the server signature to disk. Applications that bundle JupyterLab, including affected Notebook and JupyterLite releases, inherit the behavior. This issue is fixed in versions 4.5.11 and 4.6.4.

• CWE-367
• CWE-863

• https://github.com/jupyterlab/jupyterlab/commit/0fc18ab4ef67e431a8f6560e387193baf786c70a
• https://github.com/jupyterlab/jupyterlab/commit/b64bc88b8ca034cf158604a5cc48ca9170ea453b
• https://github.com/jupyterlab/jupyterlab/commit/f7e5f9803fdf2aaaa0e9bfb9cc73386a8cc5f0b2
• https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.11
• https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.4
• https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-jwrc-gm9j-263p

Published

Oct 13, 2026

Last Modified

Oct 16, 2026

Status

Awaiting Analysis

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-102827simple-git, an interface for running git commands in any nod…9.8
• CVE-2026-102828simple-git, an interface for running git commands in any nod…9.8
• CVE-2026-102829simple-git, an interface for running git commands in any nod…9.2
• CVE-2026-10283A vulnerability was detected in Bottelet DaybydayCRM up to 2…6.3
• CVE-2026-102830JupyterLab is an extensible environment for interactive and …6.8
• CVE-2026-102831JupyterLab is an extensible environment for interactive and …8.1
• CVE-2026-102834JavaCV provides Java interfaces to OpenCV, FFmpeg, and other…7.5
• CVE-2026-10284A flaw has been found in DevaslanPHP project-management up t…5.4
• CVE-2026-102842A vulnerability was identified in gedelumbung HospitalManage…6.3
• CVE-2026-102843A security flaw has been discovered in gedelumbung HospitalM…4.7
• CVE-2026-102844A weakness has been identified in gedelumbung HospitalManage…2.7
• CVE-2026-102845A security vulnerability has been detected in gedelumbung Ho…5.3