DEBIAN-CVE-2026-102831

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-102831
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-102831.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-102831
Upstream
Published
2026-09-29T19:17:25Z
Modified
2026-09-30T08:00:06Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N CVSS Calculator
Summary
[none]
Details

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.5.0 until 4.5.11 and 4.6.4, from Notebook 7.5.0 until 7.6.3, and from JupyterLite Core 0.7.0 until 0.8.4, the system clipboard cell-paste path accepts attacker-controlled cell JSON without clearing metadata.trusted. When useSystemClipboardForCells is active and pasteCodeCellsWithoutOutput is disabled, a pasted code cell can mark HTML output as trusted, bypass output sanitization, and execute script in the authenticated JupyterLab origin without executing the cell. Markdown and raw cells are not affected because their output is sanitized. This issue is fixed in JupyterLab 4.5.11 and 4.6.4, Notebook 7.6.3, and JupyterLite Core 0.8.4.

References

Affected packages

Debian:12 / jupyter-notebook

Package

Name
jupyter-notebook
Purl
pkg:deb/debian/jupyter-notebook?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

6.*
6.4.12-2.2
6.4.13-1
6.4.13-2
6.4.13-3
6.4.13-4
6.4.13-5
7.*
7.0.0-1
7.0.0-2
7.4.7-1
7.4.7-2
7.4.7-3

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-102831.json"

Debian:13 / jupyter-notebook

Package

Name
jupyter-notebook
Purl
pkg:deb/debian/jupyter-notebook?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

6.*
6.4.13-5
7.*
7.0.0-1
7.0.0-2
7.4.7-1
7.4.7-2
7.4.7-3

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-102831.json"

Debian:14 / jupyter-notebook

Package

Name
jupyter-notebook
Purl
pkg:deb/debian/jupyter-notebook?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

6.*
6.4.13-5
7.*
7.0.0-1
7.0.0-2
7.4.7-1
7.4.7-2
7.4.7-3

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-102831.json"

Debian:13 / jupyterlab

Package

Name
jupyterlab
Purl
pkg:deb/debian/jupyterlab?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

4.*
4.0.11+ds1+~cs11.25.27-7
4.0.11+ds1+~cs11.25.27-8
4.0.11+ds1+~cs11.25.27-9
4.0.11+ds2+~cs11.25.27-1
4.0.11+ds2+~cs11.25.27-3
4.0.11+ds3+~cs11.25.27-1
4.0.11+ds4+~cs11.25.27-1
4.0.11+ds4+~cs11.25.27-2
4.0.11+ds4+~cs11.25.27-3
4.0.11+ds4+~cs11.25.27-4
4.0.11+ds5+~cs11.25.27-1
4.0.13+ds1+~2.0.1+~cs1.4.4-1
4.1.3+ds1+~2.0.1+~0.15.3+~cs1.4.4-1
4.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-1
4.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-2
4.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-3
4.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-4
4.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-5
4.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-6
4.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-7
4.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-8
4.4.1+ds1+~3.0.5+~0.16.6+~cs1.4.4-1
4.4.8+ds1+~3.1.0+~0.16.6+~cs1.4.4-1
4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-1
4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-2
4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-3
4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-4
4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-5
4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-6

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-102831.json"

Debian:14 / jupyterlab

Package

Name
jupyterlab
Purl
pkg:deb/debian/jupyterlab?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

4.*
4.0.11+ds1+~cs11.25.27-7
4.0.11+ds1+~cs11.25.27-8
4.0.11+ds1+~cs11.25.27-9
4.0.11+ds2+~cs11.25.27-1
4.0.11+ds2+~cs11.25.27-3
4.0.11+ds3+~cs11.25.27-1
4.0.11+ds4+~cs11.25.27-1
4.0.11+ds4+~cs11.25.27-2
4.0.11+ds4+~cs11.25.27-3
4.0.11+ds4+~cs11.25.27-4
4.0.11+ds5+~cs11.25.27-1
4.0.13+ds1+~2.0.1+~cs1.4.4-1
4.1.3+ds1+~2.0.1+~0.15.3+~cs1.4.4-1
4.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-1
4.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-2
4.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-3
4.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-4
4.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-5
4.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-6
4.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-7
4.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-8
4.4.1+ds1+~3.0.5+~0.16.6+~cs1.4.4-1
4.4.8+ds1+~3.1.0+~0.16.6+~cs1.4.4-1
4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-1
4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-2
4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-3
4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-4
4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-5
4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-6

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-102831.json"