CVE-2026-102530: XSS to RCE — CRITICAL

CISO Take

JupyterLab Desktop before 4.6.2-1 fails to safely encode remote-server URLs and RSS news-feed titles in its Welcome view, so an attacker-supplied string runs JavaScript in a renderer that has a privileged IPC bridge, turning a simple XSS into arbitrary code execution with the user's privileges. No CVSS, EPSS or KEV data is available yet and there is no public exploit or Nuclei template, so exploitation likelihood is unquantified. The URL path needs a user to submit a crafted URL, which is social engineering. The feed path needs control of the Jupyter Blog feed or its cached data, which is harder. The risk is highest on data scientist workstations that hold cloud credentials, API keys, datasets and model artifacts. Upgrade to 4.6.2-1 and tell users not to paste remote-server URLs from untrusted sources until they have.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

Moderate, pending scoring. Exploitation needs user interaction (submitting a crafted URL) or compromise of the Jupyter Blog feed or its cached data. The impact is full code execution as the user, which can reach credentials, notebooks and model files. There is no known in-the-wild exploitation, no public exploit and no KEV listing. Exposure is limited to desktop installs, not servers. The impact would be higher in organizations where developer endpoints hold privileged cloud or ML platform access.

How does the attack unfold?

Initial Access

The attacker convinces the user to submit a crafted remote-server URL, or tampers with the Jupyter Blog feed content.

AML.T0011.003

Exploitation

Unencoded input is rendered in the Welcome view and runs attacker JavaScript in the renderer.

AML.T0050

Privilege Abuse

The script calls the privileged IPC bridge to run arbitrary commands as the user.

AML.T0050

Impact

The attacker steals credentials, notebooks and model artifacts, or tampers with them, and pivots into ML infrastructure.

AML.T0025

Initial Access

The attacker convinces the user to submit a crafted remote-server URL, or tampers with the Jupyter Blog feed content.

AML.T0011.003

Exploitation

Unencoded input is rendered in the Welcome view and runs attacker JavaScript in the renderer.

AML.T0050

Privilege Abuse

The script calls the privileged IPC bridge to run arbitrary commands as the user.

AML.T0050

Impact

The attacker steals credentials, notebooks and model artifacts, or tampers with them, and pivots into ML infrastructure.

AML.T0025

How severe is it?

CVSS 3.1

N/A

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Moderate

What should I do?

6 steps

Upgrade JupyterLab Desktop to 4.6.2-1 or later (see GHSA-vrj4-r4fw-9rfh).
Inventory installs via endpoint management and software inventory tools and force the update.
Until patched, instruct users not to enter remote-server URLs from emails, chats or untrusted documents.
Consider blocking or proxying the Jupyter Blog feed for unpatched clients.
Hunt for the JupyterLab Desktop process spawning unexpected child processes such as shells, curl or PowerShell.
Rotate API keys and tokens on any workstation suspected of compromise.

How is it classified?

Code ExecutionSocial EngineeringFrameworkAML.T0011.003- Malicious Link AML.T0050- Command and Scripting Interpreter AML.T0112.000- Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Respond to previously unknown risks

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-102530?

JupyterLab Desktop before 4.6.2-1 fails to safely encode remote-server URLs and RSS news-feed titles in its Welcome view, so an attacker-supplied string runs JavaScript in a renderer that has a privileged IPC bridge, turning a simple XSS into arbitrary code execution with the user's privileges. No CVSS, EPSS or KEV data is available yet and there is no public exploit or Nuclei template, so exploitation likelihood is unquantified. The URL path needs a user to submit a crafted URL, which is social engineering. The feed path needs control of the Jupyter Blog feed or its cached data, which is harder. The risk is highest on data scientist workstations that hold cloud credentials, API keys, datasets and model artifacts. Upgrade to 4.6.2-1 and tell users not to paste remote-server URLs from untrusted sources until they have.

Is CVE-2026-102530 actively exploited?

No confirmed active exploitation of CVE-2026-102530 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-102530?

1. Upgrade JupyterLab Desktop to 4.6.2-1 or later (see GHSA-vrj4-r4fw-9rfh). 2. Inventory installs via endpoint management and software inventory tools and force the update. 3. Until patched, instruct users not to enter remote-server URLs from emails, chats or untrusted documents. 4. Consider blocking or proxying the Jupyter Blog feed for unpatched clients. 5. Hunt for the JupyterLab Desktop process spawning unexpected child processes such as shells, curl or PowerShell. 6. Rotate API keys and tokens on any workstation suspected of compromise.

What systems are affected by CVE-2026-102530?

This vulnerability affects the following AI/ML architecture patterns: Data science workstations, Notebook-based development environments, Training pipelines, Remote Jupyter server connections.

What is the CVSS score for CVE-2026-102530?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

Data science workstationsNotebook-based development environmentsTraining pipelinesRemote Jupyter server connections

MITRE ATLAS Techniques

AML.T0011.003Malicious Link

AML.T0050Command and Scripting Interpreter

AML.T0112.000Local AI Agent

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, remote-server URLs were inserted into the server-selection dialog and Welcome view without safe encoding. An attacker who convinces a user to submit a crafted URL can execute JavaScript in the Welcome renderer and abuse its privileged IPC bridge to execute arbitrary code with the user’s privileges. The Welcome view also unsafely renders RSS news-feed titles; exploitation through this separate input path requires control over content delivered through the application’s Jupyter Blog feed or its cached feed data, rather than submission of a remote-server URL. This issue affects all supported platforms and is fixed in version 4.6.2-1.

Exploitation Scenario

An attacker posts a convincing link or setup instruction in a data science community channel, a phishing email or a shared README that tells users to connect JupyterLab Desktop to a 'shared GPU server' at a crafted URL. The URL carries an HTML/JavaScript payload. When the victim submits it, the payload runs in the Welcome renderer and calls the privileged IPC bridge to run commands. The attacker then steals cloud and LLM API credentials, notebooks and model files from the workstation, and may plant a backdoor in shared notebooks.

Weaknesses (CWE)

CWE-116Improper Encoding or Escaping of OutputPrimary CWE-79Improper Neutralization of Input During Web Page GenerationPrimary CWE-94Improper Control of Generation of CodePrimary CWE-116Improper Encoding or Escaping of Output CWE-79Improper Neutralization of Input During Web Page Generation CWE-94Improper Control of Generation of Code

CWE-116 — Improper Encoding or Escaping of Output: The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, consider using the ESAPI Encoding control [REF-45] or a similar tool, library, or framework. These will help the programmer encode outputs in a manner less prone to error. Alternately, use built-in functions, but consider using wrappers in case those functions are discovered to have a vulnerability.
[Architecture and Design] If available, use structured mechanisms that automatically enforce the separation between data and code. These mechanisms may be able to provide the relevant quoting, encoding, and validation automatically, instead of relying on the developer to provide this capability at every point where output is generated. For example, stored procedures can enforce database query structure and reduce the likelihood of SQL injection.

Source: MITRE CWE corpus.