JupyterLab Desktop: XSS and one-click token-leak RCE (CVE-2026-102530 / CVE-2026-86044) plus macOS TCC bypasses — fixed in 4.6.2-1 · updates https://pwn.watch/i/jupyterlab-desktop-xss-token-leak-rce-cve-2026-102530 NVD published four JupyterLab Desktop CVEs on 2026-11-06 for issues patched in the Jul 22 2026 v4.6.2-1 security release (first Desktop release in two years). Two are critical remote code execution: CVE-2026-102530 (CVSS 9.4) — unsanitized remote-server URLs in the Connect dialog / Welcome view enable XSS that abuses the privileged Electron IPC bridge; and CVE-2026-86044 (CVSS 9.6) — a MathJax link in an untrusted notebook plus a getServerInfo IPC leak lets one click hand the local Jupyter server token to an attacker site for RCE (requires JupyterLab < 4.4.8 in the managed environment). Two medium macOS-only TCC bypasses (CVE-2025-54991 / CVE-2025-55002, CVSS 5.5) need existing local code execution. Affected: Desktop <= v4.2.5-1. Upgrade to 4.6.2-1. en Fri, 06 Nov 2026 00:00:00 GMT JupyterLab Desktop: XSS and one-click token-leak RCE (CVE-2026-102530 / CVE-2026-86044) plus macOS TCC bypasses — fixed in 4.6.2-1: NVD receives CVE-2026-102530 (CVSS 9.4), CVE-2026-86044 (CVSS 9.6), CVE-2025-54991 and CVE-2025-55002 (both CVSS 5.5) from security-advisories@github.com, linking the Jul 2026 Desktop security release. https://pwn.watch/i/jupyterlab-desktop-xss-token-leak-rce-cve-2026-102530 https://pwn.watch/i/jupyterlab-desktop-xss-token-leak-rce-cve-2026-102530#2026-11-06-232a4aad Fri, 06 Nov 2026 00:00:00 GMT critical <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-102530">Source</a></p> JupyterLab Desktop: XSS and one-click token-leak RCE (CVE-2026-102530 / CVE-2026-86044) plus macOS TCC bypasses — fixed in 4.6.2-1: GitHub Security Advisories published for the four Desktop issues (CVE assignment noted as pending at the time for the two critical RCE advisories). https://pwn.watch/i/jupyterlab-desktop-xss-token-leak-rce-cve-2026-102530 https://pwn.watch/i/jupyterlab-desktop-xss-token-leak-rce-cve-2026-102530#2026-07-24-21b2a582 Fri, 24 Jul 2026 00:00:00 GMT critical <p><a href="https://github.com/jupyterlab/jupyterlab-desktop/security/advisories/GHSA-vrj4-r4fw-9rfh">Source</a></p> JupyterLab Desktop: XSS and one-click token-leak RCE (CVE-2026-102530 / CVE-2026-86044) plus macOS TCC bypasses — fixed in 4.6.2-1: JupyterLab Desktop v4.6.2-1 released with patches for GHSA-vrj4-r4fw-9rfh (XSS→RCE via Connect URL), GHSA-2mr8-962v-wc67 (one-click token leak→RCE), GHSA-8cvf-4977-r95v (CVE-2025-54991 TCC), and GHSA-5c3f-5gj7-p9xh (CVE-2025-55002 TCC). https://pwn.watch/i/jupyterlab-desktop-xss-token-leak-rce-cve-2026-102530 https://pwn.watch/i/jupyterlab-desktop-xss-token-leak-rce-cve-2026-102530#2026-07-22-c88ab40f Wed, 22 Jul 2026 00:00:00 GMT critical <p><a href="https://github.com/jupyterlab/jupyterlab-desktop/releases/tag/v4.6.2-1">Source</a></p>