CVE-2026-42557

Affected versions of the jupyterlab package are vulnerable to Improper Neutralisation of Input During Web Page Generation due to the HTML sanitiser allowlisting the data-commandlinker-command and data-commandlinker-args attributes on button elements while the CommandLinker handler executes the named command without verifying the origin of the click target. The CommandLinker registers a global click listener on document.body that dispatches whichever command is named in the data-commandlinker-command attribute of the clicked element, so a notebook or Markdown file containing a pre-saved HTML cell output with a deceptive button rendered in the output area is sufficient to invoke arbitrary JupyterLab commands without any code being submitted to a kernel. An attacker who shares a notebook or Markdown file via email, GitHub, or a Binder link can, on a single victim click, execute arbitrary code in available kernels, delete files, or spawn multiple kernels and terminals to exhaust server resources, and through a multi-click sequence that grants clipboard access on Chromium-based browsers can obtain full terminal access in the user environment.