JupyterLab Desktop: Cross-Site Scripting (XSS) leading to Remote Code Execution on Connect URL

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, remote-server URLs were inserted into the server-selection dialog and Welcome view without safe encoding. An attacker who convinces a user to submit a crafted URL can execute JavaScript in the Welcome renderer and abuse its privileged IPC bridge to execute arbitrary code with the user’s privileges. The Welcome view also unsafely renders RSS news-feed titles; exploitation through this separate input path requires control over content delivered through the application’s Jupyter Blog feed or its cached feed data, rather than submission of a remote-server URL. This issue affects all supported platforms and is fixed in version 4.6.2-1.

Etkilenen sürümler1 yazılım

Kaynaklar5 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…esktop/security/advisories/GHSA-vrj4-r4fw-9rfh Diğer
• github.com/…ommit/f59fd4f61bc6a2ca89cf0d13dce5f60511eaef5d Diğer
• github.com/…erlab/jupyterlab-desktop/releases/tag/v4.6.2-1 Diğer

Kayıt geçmişi

1. 6 Kas 2026 23:35Yayımlandı

İlgili açıklar

• 5,5 CVE-2025-55002JupyterLab Desktop: TCC Bypass via Misconfigured Node Fuses
• 9,6 CVE-2026-86044JupyterLab Desktop: One-Click Jupyter Server Token Leak leading to Remote Code Execution
• 5,5 CVE-2025-54991JupyterLab Desktop: TCC Bypass via Insecure Entitlements (macOS)
• 5,3 CVE-2026-103022Urwid: handle_short_request() crashes on non-ASCII POST body (UnicodeEncodeError DoS)
• 6,3 CVE-2026-55649GeoNode has Stored XSS in Documents metadata abstract field
• 7,6 CVE-2026-62346Wanderer: Stored XSS via waypoint.name and waypoint.icon in Elevation Profile innerHTML