CVE-2026-40171: Jupyter Notebook and JupyterLab token theft via stored XSS in help command linker
Impact
A stored Cross-Site Scripting (XSS) vulnerability in Jupyter Notebook allows attackers to steal authentication tokens from users who open malicious notebook files and interact with elements that the attacker can make look indistinguishable from legitimate controls (single click interaction).
The vulnerability enables complete account takeover through the Jupyter REST API, allowing the attacker to: 1. Read all files 2. Modify/create files 3. Access running kernels and execute arbitrary code 4. Create terminals for shell access
Patches
Jupyter Notebook 7.5.6 and JupyterLab 4.5.7 include patches for this vulnerability.
Workarounds
The help extension can be disabled via CLI:
jupyter labextension disable @jupyter-notebook/help-extension jupyter labextension disable @jupyterlab/help-extension
Hardening
The patched versions include a toggle to disable the command linker functionality altogether, for example via overrides.json:
json { "@jupyterlab/apputils-extension:sanitizer": { "allowCommandLinker": false } }
Resources
- https://jupyterlab.readthedocs.io/en/latest/user/commands.html#commands-in-markdown-output-and-files
Acknowledgments
Reported by Daniel Teixeira - NVIDIA AI Red Team
Other sources
In Jupyter Notebook versions 7.0.0 through 7.5.5, JupyterLab versions 4.5.6 and earlier, and the corresponding @jupyter-notebook/help-extension and @jupyterlab/help-extension packages before 7.5.6 and 4.5.7, a stored cross-site scripting issue in the help command linker can be chained with attacker-controlled notebook content to steal authentication tokens with a single click.
An attacker can craft a malicious notebook file containing elements that appear indistinguishable from legitimate controls and trigger execution when a user interacts with them. Successful exploitation allows theft of the user's authentication token and complete takeover of the Jupyter session through the REST API, including reading files, creating or modifying files, accessing kernels to execute arbitrary code, and creating terminals for shell access. This issue has been fixed in Notebook 7.5.6, JupyterLab 4.5.7, @jupyter-notebook/help-extension 7.5.6, and @jupyterlab/help-extension 4.5.7. As a workaround, disable the affected help extensions or set allowCommandLinker to false in the sanitizer configuration.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@jupyterlab/help-extensionto a version that resolves this vulnerability.Fixed in 4.5.7 - Upgrade
Upgrade
pip/jupyterlabto a version that resolves this vulnerability.Fixed in 4.5.7 - Upgrade
Upgrade
pip/notebookto a version that resolves this vulnerability.Fixed in 7.5.6 - Upgrade
Upgrade
npm/@jupyter-notebook/help-extensionto a version that resolves this vulnerability.Fixed in 7.5.6 - Upgrade
Upgrade
Jupyter Notebookto a version that resolves this vulnerability.Fixed in 7.5.6 - Upgrade
Upgrade
JupyterLabto a version that resolves this vulnerability.Fixed in 4.5.7 - Upgrade
Upgrade
@jupyter-notebook/help-extensionto a version that resolves this vulnerability.Fixed in 7.5.6 - Upgrade
Upgrade
@jupyterlab/help-extensionto a version that resolves this vulnerability.Fixed in 4.5.7 - Configuration
Set allowCommandLinker to false in the sanitizer configuration to disable the help command linker functionality as a workaround.
@jupyterlab/apputils-extension:sanitizer allowCommandLinker = false - Configuration
Disable the help extensions via CLI: run `jupyter labextension disable @jupyter-notebook/help-extension` and `jupyter labextension disable @jupyterlab/help-extension` as a workaround (especially for affected versions prior to 7.5.6 / 4.5.7).
Jupyter Notebook help extensions (CLI) enabled = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40171?
CVE-2026-40171 is a stored Cross-Site Scripting (XSS) vulnerability, which may allow attackers to steal authentication tokens.
How do I fix CVE-2026-40171?
To fix CVE-2026-40171, upgrade to the latest versions of the affected packages, specifically to JupyterLab 4.5.7 or Notebook 7.5.6.
What are the affected software versions for CVE-2026-40171?
CVE-2026-40171 affects JupyterLab versions up to 4.5.6 and Notebook versions between 7.0.0 and 7.5.5.
Who can exploit CVE-2026-40171?
Any attacker can exploit CVE-2026-40171 by crafting malicious Jupyter Notebook files that users may open.
What is the impact of CVE-2026-40171?
The impact of CVE-2026-40171 includes the potential theft of user authentication tokens, compromising user sessions.