The clipboard cell‑paste mechanism in JupyterLab, JupyterLite Core, and the Jupyter Notebook architecture accepts attacker‑controlled JSON objects without clearing the trusted metadata flag. When the useSystemClipboardForCells setting is enabled and pasteCodeCellsWithoutOutput is disabled, a code cell can tag its HTML output as trusted. Trusted output bypasses Jupyter’s sanitization step, enabling embedded <script> payloads to run within the user’s browser without the cell executing. This results in a client‑side cross‑site scripting flaw that can persist in a trusted context, potentially exposing credentials or enabling further server‑side exploitation. The flaw does not affect Markdown or raw cells because their output is always sanitized. The vulnerability is limited to cells pasted from the system clipboard; it does not require network access beyond the authenticated JupyterLab origin.

The flaw affects JupyterLab versions 4.5.0 through 4.5.11 and 4.6.0 through 4.6.4, the Jupyter Notebook versions 7.5.0 through 7.6.3, and JupyterLite Core versions 0.7.0 through 0.8.4. All products are listed under the jupyterlab:jupyterlab, jupyterlab:jupyterlite-core, and jupyterlab:notebook CNAs.

The CVSS score of 8.1 indicates a high severity risk. EPSS information is not available, but the vulnerability is not in the CISA KEV catalog. Attackers who can inject malicious clipboard content can trigger the flaw; this typically requires local user interaction or an exploited user session. Once a trusted HTML payload is pasted, scripts execute in the authenticated origin, yielding full client‑side privileges for the user. Because the attack does not directly require network intrusion, its probability hinges on user behavior or compromised local software.