CVE-2026-42557 is a critical flaw (CVSS 9.6) in JupyterLab before 4.5.7. HTML saved in a notebook can contain a button that runs arbitrary JupyterLab commands, including code execution, when a user clicks it. Upgrade to JupyterLab 4.5.7, and Notebook to 7.5.6 if you use version 7.
What's affected
The advisory lists these ranges and fixes:
- JupyterLab 4.5.6 and earlier, fixed in 4.5.7.
- The notebook package on pip, versions 7.0.0 up to 7.5.5, fixed in 7.5.6.
The NVD record names JupyterLab before 4.5.7. Red Hat has also published errata, so distribution packages may be fixed under their own version numbers.
How to check if you're exposed
pip show jupyterlab notebook
jupyter lab --version
If you use conda, run conda list jupyterlab notebook instead. Compare the result with the fixed versions above.
Then think about where notebooks come from. The attack needs a notebook or Markdown file that the user opens and then clicks in. Shared drives, email attachments, public repositories and Binder links are the usual routes. Shared JupyterHub servers deserve a look first, since many users open files from many sources there.
What to do now
- Upgrade JupyterLab to 4.5.7 or later and the notebook package to 7.5.6 or later.
- Rebuild any container images and JupyterHub user images that pin older versions.
- Tell users not to click buttons inside outputs of notebooks from sources they do not trust.
- Open untrusted notebooks in the Trusted state only after review, and prefer a disposable environment for unfamiliar files.
- Keep credentials and cloud tokens out of the environments where people open outside notebooks.
Why it matters
The class is CWE-79, cross site scripting, though the effect is closer to command injection. JupyterLab sanitizes HTML in outputs, but its allow list kept two data attributes on button elements. A separate component, CommandLinker, listens for every click on the page and runs the command named in those attributes without checking that the button came from trusted interface code.
So the sanitizer let the attribute through and the listener trusted it. A single click was enough, with no cell executed by the user. The KEV flag is false, and I found no claim of exploitation in the advisory.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does the user have to run a cell?
No. The advisory says one click on the button is enough, with no code submitted for execution by the user.
Is the classic Notebook package affected?
The advisory lists the notebook pip package in the 7.0.0 to 7.5.5 range, fixed in 7.5.6.
Sources
Last reviewed: 19 October 2026.
