Untrusted HTML content can be embedded within a JupyterLab notebook cell. The notebook’s output rendering system includes a data-commandlinker attribute that, when clicked, causes JupyterLab’s command execution engine to invoke the specified command without verifying that the element originated from trusted UI components. Because the command linker can trigger any JupyterLab command—including those that execute arbitrary code—the attacker’s deceptive button can cause a single click to run code on the user’s machine. This flaw is a type of cross-site scripting that enables injection of privileged commands.

The vulnerability applies to all releases of JupyterLab and Jupyter Notebook prior to version 4.5.7. Specifically, both the jupyter:notebook and jupyterlab:jupyterlab products are affected when the sanitization rules still allow data-commandlinker-command and data-commandlinker-args attributes on button elements.

The vulnerability has a CVSS score of 8.6, indicating a high severity. EPSS data is not available, and it is not listed in the CISA KEV catalog. The likely attack vector is a user opening a notebook containing maliciously crafted output; a single click on the deceptive button is sufficient to trigger the exploit. The impact is total loss of confidentiality, integrity, and availability for the authenticated user session. Given the lack of mitigation from the user side, the risk of exploitation in environments that accept untrusted notebooks is significant.