CVE Watch6 de nov. de 2026

CVE-2026-102530

JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, remote-server URLs were inserted into the ser

CVSS

—

Sem CVSS

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 6 de nov. de 2026 · Última mod.: 6 de nov. de 2026 · CWE-79 · CWE-94 · CWE-116

EPSS · 30d

Ainda não há histórico EPSS suficiente.

Descrição técnica

JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, remote-server URLs were inserted into the server-selection dialog and Welcome view without safe encoding. An attacker who convinces a user to submit a crafted URL can execute JavaScript in the Welcome renderer and abuse its privileged IPC bridge to execute arbitrary code with the user’s privileges. The Welcome view also unsafely renders RSS news-feed titles; exploitation through this separate input path requires control over content delivered through the application’s Jupyter Blog feed or its cached feed data, rather than submission of a remote-server URL. This issue affects all supported platforms and is fixed in version 4.6.2-1.

Referências oficiais

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-71881—

—

———Multiple injection issues in resource metadata fields in GBIF Integrated Publishing Toolkit versions before 3.3.5 allows authenticated remote attackers to execute code in another user's session after user interaction via stored cross-site scripting3h CVE-2026-1208456.5 MÉD

—

———Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Smush Image Compression and Optimization wp-smushit allows Stored XSS.This issue affects Smush Image Compression and Optimization: from n/a through 4.3.5.4h CVE-2026-1030225.3 MÉD

—

———Urwid is a console user interface library for Python. Prior to 4.0.7, handle_short_request() in urwid/display/web.py performs unguarded character encoding on POST input and unguarded UTF-8 decoding on polling update socket output. A remote attacker who obtains a valid X-Urwid-ID session token can submit non-ASCII POST data that raises UnicodeEncodeError, while non-UTF-8 polling output raises UnicodeDecodeError, causing the CGI handler to return an error and terminate request processing. The POST exception path also leaves an opened file descriptor unclosed for the CGI process lifetime, so repeated requests can cause denial of service for the web display interface. This issue is fixed in version 4.0.7.5h CVE-2025-550025.5 MÉD

—

———JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, JupyterLab Desktop for macOS shipped with Electron's RunAsNode fuse enabled, allowing ELECTRON_RUN_AS_NODE to execute arbitrary Node.js code in the application process. An attacker who can already execute code as the current user can therefore run code in JupyterLab Desktop's context and inherit TCC permissions previously granted to the application, including access to protected Documents, Desktop, or Downloads folders without another macOS prompt. Exploitation requires existing local code execution and prior TCC grants; it does not provide initial or remote code execution. Windows and Linux are not affected. This vulnerability is fixed in 4.6.2-1.6h CVE-2026-556496.3 MÉD

—

——0GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.0.3, document abstract metadata is stored without sanitization, allowing a low-privileged remote user to persist arbitrary HTML and JavaScript that executes in another user's browser when the document page is visited. This issue is fixed in version 5.0.3.5h CVE-2026-623467.6 ALT

—

——0Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, an authenticated local user can submit crafted waypoint.name and waypoint.icon values that the trail elevation graph interpolates into an innerHTML template in web/src/lib/vendor/maplibre-elevation-profile/elevationprofile.ts without HTML encoding or icon validation. A victim viewing the elevation profile executes the attacker-controlled script in their browser. Separately, federated waypoints can deliver the same malicious fields across instances without requiring the attacker to have a local account on the receiving instance. The script can expose session data or perform actions in the victim's context. This issue is fixed in version 0.19.3.8h