Opening an untrusted notebook is lower risk than running it. Jupyter hides saved HTML and JavaScript output from notebooks it has no matching signature for. But running its cells executes arbitrary Python as you, so read the code first, or run it in a disposable environment.
What the trust model does
Jupyter's documentation says the trust model aims to prevent untrusted code from executing on your behalf when notebooks open. The server stores a signature for each trusted notebook and checks it every time one is opened.
- Trusted: a notebook you executed fully yourself counts as trusted, and its HTML and JavaScript output displays on load.
- Untrusted: with no matching signature, JavaScript and HTML output is not displayed until you regenerate it by running the cells.
- Manual trust: if you must see the output without rerunning and are confident the notebook is not malicious, a jupyter trust command marks it trusted.
This guards the viewing step. It does nothing about code cells you choose to run.
Two different risks
| Action | Risk | Protected by trust model |
|---|---|---|
| Open and read | Hidden script in saved output | Yes, output is withheld |
| Run all cells | Arbitrary code runs as you | No |
| Install packages from a cell | Install scripts and new code | No |
A notebook can contain shell commands, package installs and file access, in plain sight in a code cell. The trust model is not a code review.
How to check an unknown notebook
- Open it in a viewer that does not execute anything, or read the raw file.
- Search code cells for install commands, shell escapes, network calls, and reads of credentials or home folders.
- Look at saved outputs, which may carry HTML you should not trust.
- Run it only inside a disposable container or machine with no secrets, and no access to internal networks.
- Clean outputs before you share your own. See clean notebook outputs before you commit.
Notebooks from hosted tools
Notebooks often arrive from shared drives, tutorials and notebook hosting sites. A familiar source does not make a file safe, because notebooks can be edited by anyone who can write to the share. When a notebook installs packages in its first cell, treat that as the highest risk line in the file: it can add code that stays in your environment after the notebook is closed.
Where the server matters too
A notebook server that is reachable from the network is a bigger problem than any single notebook, because it lets others run code. See the Jupyter server exposed to the network checklist.
Quick check
Does the trust model stop malicious code cells?
No. It withholds saved HTML and JavaScript output. Code cells run when you run them.
Is a notebook I ran myself trusted?
Yes, per the documentation, a notebook you executed fully yourself counts as trusted.
Safeguard's SAST code scanning can review Python code for risky patterns, and a free scan is a place to start.
Sources
Last reviewed: 19 October 2026.
