{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "JupyterLab Desktop: XSS and one-click token-leak RCE (CVE-2026-102530 / CVE-2026-86044) plus macOS TCC bypasses — fixed in 4.6.2-1 · updates",
  "home_page_url": "https://pwn.watch/i/jupyterlab-desktop-xss-token-leak-rce-cve-2026-102530",
  "feed_url": "https://pwn.watch/i/jupyterlab-desktop-xss-token-leak-rce-cve-2026-102530/feed.json",
  "description": "NVD published four JupyterLab Desktop CVEs on 2026-11-06 for issues patched in the Jul 22 2026 v4.6.2-1 security release (first Desktop release in two years). Two are critical remote code execution: CVE-2026-102530 (CVSS 9.4) — unsanitized remote-server URLs in the Connect dialog / Welcome view enable XSS that abuses the privileged Electron IPC bridge; and CVE-2026-86044 (CVSS 9.6) — a MathJax link in an untrusted notebook plus a getServerInfo IPC leak lets one click hand the local Jupyter server token to an attacker site for RCE (requires JupyterLab < 4.4.8 in the managed environment). Two medium macOS-only TCC bypasses (CVE-2025-54991 / CVE-2025-55002, CVSS 5.5) need existing local code execution. Affected: Desktop <= v4.2.5-1. Upgrade to 4.6.2-1.",
  "language": "en",
  "_pwn": {
    "slug": "jupyterlab-desktop-xss-token-leak-rce-cve-2026-102530",
    "severity": "critical",
    "status": "live",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/jupyterlab-desktop-xss-token-leak-rce-cve-2026-102530/feed.xml",
    "llms": "https://pwn.watch/i/jupyterlab-desktop-xss-token-leak-rce-cve-2026-102530/llms.txt",
    "json": "https://pwn.watch/i/jupyterlab-desktop-xss-token-leak-rce-cve-2026-102530.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/jupyterlab-desktop-xss-token-leak-rce-cve-2026-102530#2026-11-06-232a4aad",
      "url": "https://pwn.watch/i/jupyterlab-desktop-xss-token-leak-rce-cve-2026-102530#2026-11-06-232a4aad",
      "title": "JupyterLab Desktop: XSS and one-click token-leak RCE (CVE-2026-102530 / CVE-2026-86044) plus macOS TCC bypasses — fixed in 4.6.2-1: NVD receives CVE-2026-102530 (CVSS 9.4), CVE-2026-86044 (CVSS 9.6), CVE-2025-54991 and CVE-2025-55002 (both CVSS 5.5) from security-advisories@github.com, linking the Jul 2026 Desktop security release.",
      "content_text": "JupyterLab Desktop: XSS and one-click token-leak RCE (CVE-2026-102530 / CVE-2026-86044) plus macOS TCC bypasses — fixed in 4.6.2-1: NVD receives CVE-2026-102530 (CVSS 9.4), CVE-2026-86044 (CVSS 9.6), CVE-2025-54991 and CVE-2025-55002 (both CVSS 5.5) from security-advisories@github.com, linking the Jul 2026 Desktop security release.\n\nSource: https://nvd.nist.gov/vuln/detail/CVE-2026-102530",
      "date_published": "2026-11-06T00:00:00.000Z",
      "external_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102530",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/jupyterlab-desktop-xss-token-leak-rce-cve-2026-102530#2026-07-24-21b2a582",
      "url": "https://pwn.watch/i/jupyterlab-desktop-xss-token-leak-rce-cve-2026-102530#2026-07-24-21b2a582",
      "title": "JupyterLab Desktop: XSS and one-click token-leak RCE (CVE-2026-102530 / CVE-2026-86044) plus macOS TCC bypasses — fixed in 4.6.2-1: GitHub Security Advisories published for the four Desktop issues (CVE assignment noted as pending at the time for the two critical RCE advisories).",
      "content_text": "JupyterLab Desktop: XSS and one-click token-leak RCE (CVE-2026-102530 / CVE-2026-86044) plus macOS TCC bypasses — fixed in 4.6.2-1: GitHub Security Advisories published for the four Desktop issues (CVE assignment noted as pending at the time for the two critical RCE advisories).\n\nSource: https://github.com/jupyterlab/jupyterlab-desktop/security/advisories/GHSA-vrj4-r4fw-9rfh",
      "date_published": "2026-07-24T00:00:00.000Z",
      "external_url": "https://github.com/jupyterlab/jupyterlab-desktop/security/advisories/GHSA-vrj4-r4fw-9rfh",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/jupyterlab-desktop-xss-token-leak-rce-cve-2026-102530#2026-07-22-c88ab40f",
      "url": "https://pwn.watch/i/jupyterlab-desktop-xss-token-leak-rce-cve-2026-102530#2026-07-22-c88ab40f",
      "title": "JupyterLab Desktop: XSS and one-click token-leak RCE (CVE-2026-102530 / CVE-2026-86044) plus macOS TCC bypasses — fixed in 4.6.2-1: JupyterLab Desktop v4.6.2-1 released with patches for GHSA-vrj4-r4fw-9rfh (XSS→RCE via Connect URL), GHSA-2mr8-962v-wc67 (one-click token leak→RCE), GHSA-8cvf-4977-r95v (CVE-2025-54991 TCC), and GHSA-5c3f-5gj7-p9xh (CVE-2025-55002 TCC).",
      "content_text": "JupyterLab Desktop: XSS and one-click token-leak RCE (CVE-2026-102530 / CVE-2026-86044) plus macOS TCC bypasses — fixed in 4.6.2-1: JupyterLab Desktop v4.6.2-1 released with patches for GHSA-vrj4-r4fw-9rfh (XSS→RCE via Connect URL), GHSA-2mr8-962v-wc67 (one-click token leak→RCE), GHSA-8cvf-4977-r95v (CVE-2025-54991 TCC), and GHSA-5c3f-5gj7-p9xh (CVE-2025-55002 TCC).\n\nSource: https://github.com/jupyterlab/jupyterlab-desktop/releases/tag/v4.6.2-1",
      "date_published": "2026-07-22T00:00:00.000Z",
      "external_url": "https://github.com/jupyterlab/jupyterlab-desktop/releases/tag/v4.6.2-1",
      "tags": [
        "critical"
      ]
    }
  ]
}