https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 14:54:23 +0000 https://cve.radiocsirt.org/vuln/brew-jupyterlab-cve-2026-73417 <p><strong>Affected:</strong> Homebrew: jupyterlab</p> <p>JupyterLab 4.5+ allows notebook settings to be shared and applied through an `overrides.json` file using the `Import` button in the Settings Editor.</p> <p>Certain notebook display settings were not properly validated before being applied. As a result, a crafted settings file could contain hidden instructions that run as code inside JupyterLab when imported, instead of only changing a display preference.</p> <p>Because importing a settings file appears harmless, a user could import a file shared by another party without realizing it could do more. On multi-tenant file systems without proper permission control, another user could plant a malicious `overrides.json`.</p> <p>&gt; CVE assignment pending, GitHub CNA is experiencing severe backlog</p> <p>### Impact</p> <p>When a malicious settings file is applied, the embedded code runs with the same access as the affected user. This could allow an attacker to read or modify that user&#39;s notebooks and files, and to run code on the user&#39;s behalf through the notebook server, including on any connected kernel.</p> <p>#### User Interaction vs Privileges Required</p> <p>##### Write access to a loaded settings location</p> <p>If an attacker can write to a directory JupyterLab loads settings from (e.g. on shared or multi-tenant file system), they could place a crafted `overrides.json` that is applied to another user automatically at startup. This requires high privilages but no action by the victim.</p> <p>##### User-imported settings file</p> <p>A user can import a crafted `overrides.json` through t…</p> <p><strong>Affected:</strong> Homebrew: jupyterlab</p> <p>JupyterLab 4.5+ allows notebook settings to be shared and applied through an `overrides.json` file using the `Import` button in the Settings Editor.</p> <p>Certain notebook display settings were not properly validated before being applied. As a result, a crafted settings file could contain hidden instructions that run as code inside JupyterLab when imported, instead of only changing a display preference.</p> <p>Because importing a settings file appears harmless, a user could import a file shared by another party without realizing it could do more. On multi-tenant file systems without proper permission control, another user could plant a malicious `overrides.json`.</p> <p>&gt; CVE assignment pending, GitHub CNA is experiencing severe backlog</p> <p>### Impact</p> <p>When a malicious settings file is applied, the embedded code runs with the same access as the affected user. This could allow an attacker to read or modify that user&#39;s notebooks and files, and to run code on the user&#39;s behalf through the notebook server, including on any connected kernel.</p> <p>#### User Interaction vs Privileges Required</p> <p>##### Write access to a loaded settings location</p> <p>If an attacker can write to a directory JupyterLab loads settings from (e.g. on shared or multi-tenant file system), they could place a crafted `overrides.json` that is applied to another user automatically at startup. This requires high privilages but no action by the victim.</p> <p>##### User-imported settings file</p> <p>A user can import a crafted `overrides.json` through t…</p> https://cve.radiocsirt.org/vuln/brew-jupyterlab-cve-2026-73417 https://cve.radiocsirt.org/vuln/cve-2026-73417 <p><strong>Affected:</strong> jupyterlab</p> <p>jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 3.3.0 until 4.5.10 and 4.6.2, JupyterLab allows notebook settings to be shared and applied through an overrides.json file using the Import button in the Settings Editor. In packages/notebook-extension/schema/tracker.json and packages/notebook-extension/src/index.ts, the sideBySideLeftMarginOverride and sideBySideRightMarginOverride settings are not properly validated before being inserted into style content, allowing a crafted settings file to contain instructions that execute as code instead of only changing display preferences. A user can import the malicious file, or an attacker with access to a shared settings location can plant an overrides.json that is applied automatically. The embedded code runs with the affected user&#39;s access and can read or modify notebooks and files and run code through the notebook server, including on a connected kernel. This issue is fixed in versions 4.5.10 and 4.6.2.</p> <p><strong>Affected:</strong> jupyterlab</p> <p>jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 3.3.0 until 4.5.10 and 4.6.2, JupyterLab allows notebook settings to be shared and applied through an overrides.json file using the Import button in the Settings Editor. In packages/notebook-extension/schema/tracker.json and packages/notebook-extension/src/index.ts, the sideBySideLeftMarginOverride and sideBySideRightMarginOverride settings are not properly validated before being inserted into style content, allowing a crafted settings file to contain instructions that execute as code instead of only changing display preferences. A user can import the malicious file, or an attacker with access to a shared settings location can plant an overrides.json that is applied automatically. The embedded code runs with the affected user&#39;s access and can read or modify notebooks and files and run code through the notebook server, including on a connected kernel. This issue is fixed in versions 4.5.10 and 4.6.2.</p> https://cve.radiocsirt.org/vuln/cve-2026-73417 https://cve.radiocsirt.org/vuln/ghsa-pppj-hq3g-57pj <p><strong>Affected:</strong> PyPI: jupyterlab</p> <p>JupyterLab 4.5+ allows notebook settings to be shared and applied through an `overrides.json` file using the `Import` button in the Settings Editor.</p> <p>Certain notebook display settings were not properly validated before being applied. As a result, a crafted settings file could contain hidden instructions that run as code inside JupyterLab when imported, instead of only changing a display preference.</p> <p>Because importing a settings file appears harmless, a user could import a file shared by another party without realizing it could do more. On multi-tenant file systems without proper permission control, another user could plant a malicious `overrides.json`.</p> <p>&gt; CVE assignment pending, GitHub CNA is experiencing severe backlog</p> <p>### Impact</p> <p>When a malicious settings file is applied, the embedded code runs with the same access as the affected user. This could allow an attacker to read or modify that user&#39;s notebooks and files, and to run code on the user&#39;s behalf through the notebook server, including on any connected kernel.</p> <p>#### User Interaction vs Privileges Required</p> <p>##### Write access to a loaded settings location</p> <p>If an attacker can write to a directory JupyterLab loads settings from (e.g. on shared or multi-tenant file system), they could place a crafted `overrides.json` that is applied to another user automatically at startup. This requires high privilages but no action by the victim.</p> <p>##### User-imported settings file</p> <p>A user can import a crafted `overrides.json` through t…</p> <p><strong>Affected:</strong> PyPI: jupyterlab</p> <p>JupyterLab 4.5+ allows notebook settings to be shared and applied through an `overrides.json` file using the `Import` button in the Settings Editor.</p> <p>Certain notebook display settings were not properly validated before being applied. As a result, a crafted settings file could contain hidden instructions that run as code inside JupyterLab when imported, instead of only changing a display preference.</p> <p>Because importing a settings file appears harmless, a user could import a file shared by another party without realizing it could do more. On multi-tenant file systems without proper permission control, another user could plant a malicious `overrides.json`.</p> <p>&gt; CVE assignment pending, GitHub CNA is experiencing severe backlog</p> <p>### Impact</p> <p>When a malicious settings file is applied, the embedded code runs with the same access as the affected user. This could allow an attacker to read or modify that user&#39;s notebooks and files, and to run code on the user&#39;s behalf through the notebook server, including on any connected kernel.</p> <p>#### User Interaction vs Privileges Required</p> <p>##### Write access to a loaded settings location</p> <p>If an attacker can write to a directory JupyterLab loads settings from (e.g. on shared or multi-tenant file system), they could place a crafted `overrides.json` that is applied to another user automatically at startup. This requires high privilages but no action by the victim.</p> <p>##### User-imported settings file</p> <p>A user can import a crafted `overrides.json` through t…</p> https://cve.radiocsirt.org/vuln/ghsa-pppj-hq3g-57pj