https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 02:33:23 +0000 https://cve.radiocsirt.org/vuln/cve-2026-42557 <p><strong>Affected:</strong> jupyterlab, jupyter notebook, Red Hat Migration Toolkit for Applications 8.2, Red Hat OpenShift AI 3.4, Red Hat OpenShift AI (RHOAI)</p> <p>jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.7, JupyterLab&#39;s HTML sanitizer allowlists data-commandlinker-command and data-commandlinker-args on button elements, while CommandLinker listens for all click events on document.body and executes the named command without checking whether the element came from trusted JupyterLab UI. A notebook with a pre-saved HTML cell output containing a deceptive button can trigger arbitrary JupyterLab commands - including arbitrary code execution - on a single user click, without any code being submitted for execution by the user. This vulnerability is fixed in 4.5.7.</p> <p><strong>Affected:</strong> jupyterlab, jupyter notebook, Red Hat Migration Toolkit for Applications 8.2, Red Hat OpenShift AI 3.4, Red Hat OpenShift AI (RHOAI)</p> <p>jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.7, JupyterLab&#39;s HTML sanitizer allowlists data-commandlinker-command and data-commandlinker-args on button elements, while CommandLinker listens for all click events on document.body and executes the named command without checking whether the element came from trusted JupyterLab UI. A notebook with a pre-saved HTML cell output containing a deceptive button can trigger arbitrary JupyterLab commands - including arbitrary code execution - on a single user click, without any code being submitted for execution by the user. This vulnerability is fixed in 4.5.7.</p> https://cve.radiocsirt.org/vuln/cve-2026-42557