CVE-2026-102530

UNKNOWN 0.0

JupyterLab Desktop: Cross-Site Scripting (XSS) leading to Remote Code Execution on Connect URL

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, remote-server URLs were inserted into the server-selection dialog and Welcome view without safe encoding. An attacker who convinces a user to submit a crafted URL can execute JavaScript in the Welcome renderer and abuse its privileged IPC bridge to execute arbitrary code with the user’s privileges. The Welcome view also unsafely renders RSS news-feed titles; exploitation through this separate input path requires control over content delivered through the application’s Jupyter Blog feed or its cached feed data, rather than submission of a remote-server URL. This issue affects all supported platforms and is fixed in version 4.6.2-1.

CWE	CWE-79 CWE-94 CWE-116
Vendor	jupyterlab
Product	jupyterlab-desktop
Published	Nov 6, 2026

Stay Ahead of the Next One

Get instant alerts for jupyterlab jupyterlab-desktop

Be the first to know when new unknown vulnerabilities affecting jupyterlab jupyterlab-desktop are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

jupyterlab / jupyterlab-desktop

< 4.6.2-1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/jupyterlab/jupyterlab-desktop/security/advisories/GHSA-vrj4-r4fw-9rfh github.com: https://github.com/jupyterlab/jupyterlab-desktop/commit/f59fd4f61bc6a2ca89cf0d13dce5f60511eaef5d github.com: https://github.com/jupyterlab/jupyterlab-desktop/releases/tag/v4.6.2-1