JupyterLab Desktop Local Server Token Exposure Leading to Code Execution (CVE-2026-86044)

JupyterLab Desktop is the packaged desktop app for JupyterLab, which runs notebooks against a local Jupyter server. The advisory says the app's preload bridge exposed a getServerInfo method to the page running inside its window. That method returned the local server's full address and authentication token.

The advisory says the method kept answering even after the window had navigated away from the JupyterLab page itself. Normally a notebook's security model stops a rendered link from taking over the existing window, by opening an outside site in a new window instead.

How the CVE-2026-86044 Attack Chain Works

The advisory describes three linked steps. First, in JupyterLab before 4.4.8, a link rendered by the MathJax HTML extension did not get the usual new-window handling.

Clicking that link could navigate the existing JupyterLab Desktop window itself to an outside site. Second, once that outside page was running in the same window, it could still call getServerInfo through the preload bridge and read the local server's address and token.

Third, the advisory says that token lets the outside page use the Jupyter REST API to create a notebook, mark it trusted, and open it. The advisory says that is equivalent to running code on the victim's machine.

The advisory is explicit that a victim must open an untrusted notebook and click one link inside it. JetBrains-style Safe Mode is not part of this product, so Jupyter's own notebook trust model is the only barrier the flaw gets past.

How the Score Reads

GitHub, the CNA, scores it CVSS 3.1 9.6 Critical, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. The UI:R component matches the advisory's own condition that a victim must click a link. There is no CVSS 4.0 score in the record or NVD.

What the Advisory and CISA KEV Say

GitHub's advisory was filed through its own coordinated disclosure process for open-source projects. As of CISA catalogue version 2026.11.06, CVE-2026-86044 is not in the Known Exploited Vulnerabilities catalogue.

NVD's own description states the affected range as JupyterLab Desktop prior to 4.6.2-1, on every platform the app ships for. The advisory's own structured version field is narrower, listing tested and affected installs as v4.2.5-1 and earlier, since that was the newest release when the issue was first reported.

The advisory lists four conditions that must all hold for a session to be at risk. The Desktop app must be on an affected release, and the JupyterLab version in that environment must be earlier than 4.4.8. The session must be a local one the app manages itself, which is the default, and the victim must click a link inside a notebook.

A user whose environment already runs JupyterLab 4.4.8 or later is not affected, the advisory says. The corrected link handling in that release stops the first step of the chain, even without a Desktop app update.