Jul 24, 2026
0 new incidents, 1 with updates.
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
Updated
- LivePatched
JupyterLab Desktop: XSS and one-click token-leak RCE (CVE-2026-102530 / CVE-2026-86044) plus macOS TCC bypasses — fixed in 4.6.2-1
NVD published four JupyterLab Desktop CVEs on 2026-11-06 for issues patched in the Jul 22 2026 v4.6.2-1 security release (first Desktop release in two years). Two are critical remote code execution: CVE-2026-102530 (CVSS 9.4) — unsanitized remote-server URLs in the Connect dialog / Welcome view enable XSS that abuses the privileged Electron IPC bridge; and CVE-2026-86044 (CVSS 9.6) — a MathJax link in an untrusted notebook plus a getServerInfo IPC leak lets one click hand the local Jupyter server token to an attacker site for RCE (requires JupyterLab < 4.4.8 in the managed environment). Two medium macOS-only TCC bypasses (CVE-2025-54991 / CVE-2025-55002, CVSS 5.5) need existing local code execution. Affected: Desktop <= v4.2.5-1. Upgrade to 4.6.2-1.
JupyterLab Desktop (jupyterlab/jupyterlab-desktop)Since Jul 22, 2026
