UBUNTU-CVE-2026-102832

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2026-102832

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102832.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-102832

Upstream

CVE-2026-102832

Published

2026-10-13T16:17:00Z

Modified

2026-10-17T12:57:57Z

Severity

4.2 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.7 until 4.5.11 and 4.6.4, the markdownviewer:trust and notebook:trust command-link handlers use tracker.currentWidget to resolve the current Markdown viewer or notebook when the user answers rather than retaining the document whose command button was clicked. If another document becomes current while the prompt is open and the user chooses Trust, JupyterLab marks the second document trusted while leaving the clicked document untrusted. Later command buttons in the incorrectly trusted document run without a prompt, and trusting a notebook marks all cells trusted, saves unsaved edits, and persists the server signature to disk. Applications that bundle JupyterLab, including affected Notebook and JupyterLite releases, inherit the behavior. This issue is fixed in versions 4.5.11 and 4.6.4.

References

Affected packages

Ubuntu:26.10 / jupyterlab

Package

Name: jupyterlab
Purl: pkg:deb/ubuntu/jupyterlab?arch=source&distro=stonking

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

4.*

4.0.11+ds1+~cs11.25.27-9

4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-3

4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-4

Ecosystem specific

{
    "binaries":  [
        {
            "binary_name":  "jupyterlab",
            "binary_version":  "4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-4"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102832.json"

Ubuntu:26.04:LTS / jupyterlab