8.4

CVE-2026-40171: jupyter-notebook help-extension Cross-site Scripting

CVSS: 8.4v4.0HighAwaiting analysis
AliasesGHSA-rch3-82jr-f9w9BIT-jupyter-base-notebook-2026-40171BIT-jupyter-notebook-2026-40171
Published 06-05-2026Last modified 08-05-2026
Open JSON

Vulnerability summary

CVE-2026-40171 is a high (CVSS 8.4) Cross-site Scripting vulnerability in jupyter-notebook help-extension. EPSS estimates a 0.66% chance of exploitation in the next 30 days, higher than 50.8% of scored vulnerabilities.

Overall risk
34/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.4/10
010
High · v4.0 (CVE.org)
EPSS score
0.66%
0%100%
Low · +0.19 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 3
OPENSUSE-SU-2026:10748-1OPENSUSE-SU-2026:10749-1CGA-PGRP-HF24-C5RH

Timeline

  1. 06-05-2026
    PublishedVulnerability first disclosed.
  2. 08-05-2026
    Last modifiedVulnerability information updated.

Description

In Jupyter Notebook versions 7.0.0 through 7.5.5, JupyterLab versions 4.5.6 and earlier, and the corresponding @jupyter-notebook/help-extension and @jupyterlab/help-extension packages before 7.5.6 and 4.5.7, a stored cross-site scripting issue in the help command linker can be chained with attacker-controlled notebook content to steal authentication tokens with a single click. An attacker can craft a malicious notebook file containing elements that appear indistinguishable from legitimate controls and trigger execution when a user interacts with them. Successful exploitation allows theft of the user's authentication token and complete takeover of the Jupyter session through the REST API, including reading files, creating or modifying files, accessing kernels to execute arbitrary code, and creating terminals for shell access. This issue has been fixed in Notebook 7.5.6, JupyterLab 4.5.7, @jupyter-notebook/help-extension 7.5.6, and @jupyterlab/help-extension 4.5.7. As a workaround, disable the affected help extensions or set allowCommandLinker to false in the sanitizer configuration.

CVSS metrics

8 scores · 8 sources · 1 version

EPSS trend

Probability

0.66%

Chance of exploitation in the next 30 days

Percentile

51%

Versus all other CVEs

30-day change

+0.19 pp

From 0.48% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.66%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard5 products
  • datahub-ingestion< 1.5.0.4-r0
  • datahub-ingestion-fips< 1.5.0.1-r1
  • jupyter-base-notebook< 7.5.6-r0
  • tensorflow-cpu-jupyter< 2.21.0-r2
  • tensorflow-gpu-jupyter< 2.21.0-r2
Debian2 products
  • jupyter-notebook< 7.4.7-3
  • jupyterlabAll versions (No fix recorded) | < 4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-3
Jupyterlab2 products
PyPI2 products
  • jupyterlab< 4.5.7
  • notebook≥ 7.0.0, < 7.5.6
@jupyter-notebook1 product
  • help-extension≥ 7.0.0, < 7.5.6
@jupyterlab1 product
  • help-extension< 4.5.7
Jupyter1 product
Jupyter-notebook1 product
Ubuntu1 product
  • jupyter-notebookAll versions (No fix recorded)
Wolfi1 product
  • jupyter-base-notebook< 7.5.6-r0

10 vendors · 17 products

References

11 links
Show all 11 references