CVE-2026-102832: Jupyter trust prompt race marks

Q: Is CVE-2026-102832 actively exploited?

No confirmed active exploitation of CVE-2026-102832 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-102832?

1) Upgrade JupyterLab to 4.5.11 or 4.6.4 or later, and update bundled Notebook and JupyterLite deployments to releases that include the fix. 2) Until patched, do not switch tabs or documents while a trust prompt is open, and avoid trusting notebooks from unverified sources. 3) Open third-party notebooks in isolated or disposable environments, and review them in read-only or non-executing viewers first. 4) Audit the server-side notebook signature database for unexpected trust entries on shared hosts, and clear signatures if suspicious notebooks were trusted. 5) Inventory JupyterLab versions across developer machines, JupyterHub images, and containers using pip or conda package lists.

Q: What systems are affected by CVE-2026-102832?

This vulnerability affects the following AI/ML architecture patterns: Interactive notebook environments, Training pipelines, Shared JupyterHub deployments, Browser-based JupyterLite deployments, ML development workstations.

Q: What is the CVSS score for CVE-2026-102832?

CVE-2026-102832 has a CVSS v3.1 base score of 4.2 (MEDIUM). The EPSS exploitation probability is 0.14%.

CISO Take

JupyterLab 4.5.7 through 4.5.10 and 4.6.0 through 4.6.3 resolve the document to trust from whichever widget is current when the user answers the prompt, not the one whose button was clicked. If the user switches documents while the prompt is open, the wrong notebook or Markdown file becomes trusted, and the one they meant to trust stays untrusted. Later command buttons in the wrongly trusted document then run without a prompt, which weakens the guard that stops untrusted notebook content from executing. Risk is moderate: CVSS is 4.2, no EPSS score is available, there is no public exploit and no Nuclei template, and it is not in CISA KEV. The attack needs a user to be tricked into a specific interaction sequence, so exploitation is unlikely at scale. Upgrade to JupyterLab 4.5.11 or 4.6.4, including bundled copies in Notebook and JupyterLite, and prioritize shared or multi-tenant data science environments.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

Medium risk, with a CVSS v3.1 score of 4.2 (AV:N/AC:H/PR:N/UI:R). Exploitation needs high complexity: a victim must open attacker-supplied content, click a trust command, and change the active document while the prompt is open. There is no known exploitation, no public PoC, and no KEV listing, and EPSS data is unavailable. The impact is limited to confidentiality and integrity of the notebook trust model, but trusted notebooks are a gateway to code execution in analyst environments that hold data and credentials. Environments that open notebooks from untrusted sources, such as shared notebooks, public repositories, or downloaded research artifacts, face the most exposure.

How does the attack unfold?

Initial Access

Attacker delivers a notebook or Markdown file with a trust command link to the victim.

AML.T0011

Exploitation

The victim switches documents while the trust prompt is open, so JupyterLab marks the wrong document as trusted.

Execution

Command buttons and active content in the wrongly trusted document run without a prompt.

AML.T0050

Impact

Trust state and signatures persist on disk, exposing the notebook environment to further compromise and data theft.

Initial Access

Attacker delivers a notebook or Markdown file with a trust command link to the victim.

AML.T0011

Exploitation

The victim switches documents while the trust prompt is open, so JupyterLab marks the wrong document as trusted.

Execution

Command buttons and active content in the wrongly trusted document run without a prompt.

AML.T0050

Impact

Trust state and signatures persist on disk, exposing the notebook environment to further compromise and data theft.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Jupyter	pip	—	No patch
13.5KOpenSSF 5.81.9K dependentsPushed 11d ago58% patched~28d to patchFull package profile →
Jupyter	pip	>= 4.6.0, <= 4.6.3	`4.6.4`
13.5KOpenSSF 5.81.9K dependentsPushed 11d ago58% patched~28d to patchFull package profile →
Jupyter	pip	>= 0.7.5, <= 0.8.3	`0.8.4`
13.5KOpenSSF 5.81.9K dependentsPushed 11d ago58% patched~28d to patchFull package profile →
Jupyter Notebook	pip	>= 7.5.6, <= 7.6.2	`7.6.3`
13.5KOpenSSF 5.83.0K dependentsPushed 11d ago79% patched~75d to patchFull package profile →

How severe is it?

CVSS 3.1

4.2 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 4% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACHigh

PRNone

UIRequired

SUnchanged

CLow

ILow

ANone

What should I do?

1 step

1) Upgrade JupyterLab to 4.5.11 or 4.6.4 or later, and update bundled Notebook and JupyterLite deployments to releases that include the fix. 2) Until patched, do not switch tabs or documents while a trust prompt is open, and avoid trusting notebooks from unverified sources. 3) Open third-party notebooks in isolated or disposable environments, and review them in read-only or non-executing viewers first. 4) Audit the server-side notebook signature database for unexpected trust entries on shared hosts, and clear signatures if suspicious notebooks were trusted. 5) Inventory JupyterLab versions across developer machines, JupyterHub images, and containers using pip or conda package lists.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassCode ExecutionFrameworkAML.T0011- User Execution AML.T0050- Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Respond to and recover from unknown risks

Frequently Asked Questions

What is CVE-2026-102832?

JupyterLab 4.5.7 through 4.5.10 and 4.6.0 through 4.6.3 resolve the document to trust from whichever widget is current when the user answers the prompt, not the one whose button was clicked. If the user switches documents while the prompt is open, the wrong notebook or Markdown file becomes trusted, and the one they meant to trust stays untrusted. Later command buttons in the wrongly trusted document then run without a prompt, which weakens the guard that stops untrusted notebook content from executing. Risk is moderate: CVSS is 4.2, no EPSS score is available, there is no public exploit and no Nuclei template, and it is not in CISA KEV. The attack needs a user to be tricked into a specific interaction sequence, so exploitation is unlikely at scale. Upgrade to JupyterLab 4.5.11 or 4.6.4, including bundled copies in Notebook and JupyterLite, and prioritize shared or multi-tenant data science environments.

Is CVE-2026-102832 actively exploited?

No confirmed active exploitation of CVE-2026-102832 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-102832?

1) Upgrade JupyterLab to 4.5.11 or 4.6.4 or later, and update bundled Notebook and JupyterLite deployments to releases that include the fix. 2) Until patched, do not switch tabs or documents while a trust prompt is open, and avoid trusting notebooks from unverified sources. 3) Open third-party notebooks in isolated or disposable environments, and review them in read-only or non-executing viewers first. 4) Audit the server-side notebook signature database for unexpected trust entries on shared hosts, and clear signatures if suspicious notebooks were trusted. 5) Inventory JupyterLab versions across developer machines, JupyterHub images, and containers using pip or conda package lists.

What systems are affected by CVE-2026-102832?

This vulnerability affects the following AI/ML architecture patterns: Interactive notebook environments, Training pipelines, Shared JupyterHub deployments, Browser-based JupyterLite deployments, ML development workstations.

What is the CVSS score for CVE-2026-102832?

CVE-2026-102832 has a CVSS v3.1 base score of 4.2 (MEDIUM). The EPSS exploitation probability is 0.14%.

What is the AI security impact?

Affected AI Architectures

Interactive notebook environmentsTraining pipelinesShared JupyterHub deploymentsBrowser-based JupyterLite deploymentsML development workstations

MITRE ATLAS Techniques

AML.T0011User Execution

AML.T0050Command and Scripting Interpreter

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.7 until 4.5.11 and 4.6.4, the markdownviewer:trust and notebook:trust command-link handlers use tracker.currentWidget to resolve the current Markdown viewer or notebook when the user answers rather than retaining the document whose command button was clicked. If another document becomes current while the prompt is open and the user chooses Trust, JupyterLab marks the second document trusted while leaving the clicked document untrusted. Later command buttons in the incorrectly trusted document run without a prompt, and trusting a notebook marks all cells trusted, saves unsaved edits, and persists the server signature to disk. Applications that bundle JupyterLab, including affected Notebook and JupyterLite releases, inherit the behavior. This issue is fixed in versions 4.5.11 and 4.6.4.

Exploitation Scenario

An attacker shares a notebook containing a Markdown cell with a trust command link and a second crafted notebook with active HTML or JavaScript outputs. A data scientist opens both and clicks the trust link in the first document. While the prompt is open, a timed or social-engineering cue prompts them to switch to the attacker's second notebook. They click Trust, and JupyterLab marks the attacker's notebook as trusted, saves its edits, and persists the signature. Its embedded JavaScript outputs and command buttons now run without a prompt in the analyst's session, allowing access to the Jupyter session, kernel interaction, or data and credential theft from the ML workspace.

Weaknesses (CWE)

CWE-367Time-of-check Time-of-use (TOCTOU) Race ConditionPrimary CWE-863Incorrect AuthorizationPrimary CWE-367Time-of-check Time-of-use (TOCTOU) Race Condition CWE-367Time-of-check Time-of-use (TOCTOU) Race Condition CWE-863Incorrect Authorization CWE-863Incorrect Authorization

CWE-367 — Time-of-check Time-of-use (TOCTOU) Race Condition: The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

[Implementation] The most basic advice for TOCTOU vulnerabilities is to not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but it does help to limit the false sense of security given by the check.
[Implementation] When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.

Source: MITRE CWE corpus.