CVE-2026-42557

[CVE catalog]

Severity

Critical · CVSS 9.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Published

May 6, 2026, 9:43:44 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.37% · Oct 27, 2026

A flaw was found in jupyterlab. This vulnerability allows a remote attacker to achieve arbitrary code execution by presenting a user with a specially crafted notebook containing a deceptive button in its pre-saved HTML cell output. When the user clicks this button, the CommandLinker component executes arbitrary JupyterLab commands without sufficient validation, leading to the execution of unauthorized code. jupyterlab: JupyterLab: Arbitrary code execution via deceptive button in HTML output This Important vulnerability in JupyterLab allows arbitrary code execution through a deceptive button embedded in a notebook's HTML output. When a user clicks this specially crafted button, the CommandLinker component executes unauthorized JupyterLab commands, bypassing security validation. This can lead to compromise of the user's environment, including data loss or denial of service, particularly in Red Hat products utilizing JupyterLab such as Migration Toolkit for Applications and Red Hat OpenShift AI. Exploitation requires user interaction. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.