CVE-2026-40171: 
JavaScript vulnerability analysis and mitigation

CVE-2026-40171 is a stored Cross-Site Scripting (XSS) vulnerability in Jupyter Notebook and JupyterLab, titled "Authentication Token Theft via CommandLinker XSS." It affects Jupyter Notebook versions 7.0.0 through 7.5.5, JupyterLab versions 4.5.6 and earlier, and the corresponding npm packages @jupyter-notebook/help-extension (≤7.5.5) and @jupyterlab/help-extension (≤4.5.6). The vulnerability was reported by Daniel Teixeira of the NVIDIA AI Red Team, disclosed on April 30, 2026, and published to the NVD on May 6, 2026. It carries a CVSS v4 base score of 8.4 (High) (GitHub Advisory, Jupyter Advisory).

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation / Cross-site Scripting) and CWE-601 (URL Redirection to Untrusted Site / Open Redirect). The root cause lies in the help extension's command linker functionality, which processes data-commandlinker-* attributes in rendered notebook content without sufficient sanitization, allowing attacker-controlled notebook cells to embed elements that trigger Jupyter commands when clicked. An attacker with the ability to deliver a malicious .ipynb file to a victim can craft notebook content that appears visually indistinguishable from legitimate UI controls; a single user click then executes the stored XSS payload. The attack requires the victim to open the malicious notebook in a vulnerable Jupyter instance and interact with the crafted element (GitHub Advisory, Jupyter Advisory).

Successful exploitation allows an attacker to steal the victim's Jupyter authentication token with a single click, enabling complete session takeover via the Jupyter REST API. With the stolen token, an attacker can read all files accessible to the user, create or modify files, access running kernels to execute arbitrary code, and create terminals for interactive shell access. The risk is particularly acute in multi-user JupyterHub environments or shared research settings where notebook files are routinely exchanged from potentially untrusted sources (GitHub Advisory, Jupyter Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.059% (19th percentile), indicating a currently low probability of exploitation within 30 days. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an attacker to have the ability to deliver a crafted notebook file to a target user, and the victim must open the file and click on a malicious element — reducing opportunistic exploitation risk but not eliminating targeted attack scenarios.

1. Craft malicious notebook: Create a .ipynb file containing a markdown or output cell with HTML elements that use data-commandlinker-command and related attributes to invoke a Jupyter command (e.g., triggering a help URL fetch) while visually mimicking a legitimate button or link.
2. Embed token-exfiltration payload: Configure the command linker payload to invoke a Jupyter command that causes the browser to send the user's authentication token to an attacker-controlled endpoint, leveraging the help extension's URL-handling behavior.
3. Deliver the notebook: Share the malicious .ipynb file with the target via email, a shared repository, a collaboration platform, or any other file-sharing mechanism used in the target's workflow.
4. Wait for victim interaction: When the victim opens the notebook in a vulnerable Jupyter Notebook (7.0.0–7.5.5) or JupyterLab (≤4.5.6) instance, the malicious element renders as an indistinguishable UI control.
5. Token theft on single click: The victim clicks the element; the stored XSS payload executes, exfiltrating the Jupyter authentication token to the attacker's server.
6. Session takeover: Using the stolen token, the attacker authenticates to the Jupyter REST API to read files, modify content, execute code in kernels, or open a terminal for full shell access (GitHub Advisory, Jupyter Advisory).

• Network: Unexpected outbound HTTP/HTTPS requests from the Jupyter server or user's browser to external or unknown IP addresses/domains shortly after a notebook is opened; REST API calls (e.g., to /api/contents, /api/kernels, /api/terminals) using a valid token from an unusual source IP or user agent.
• Logs: Jupyter server access logs showing REST API requests (GET/POST to /api/contents, /api/kernels, /api/terminals) from IP addresses not associated with the legitimate user session; token-authenticated requests immediately following notebook open events.
• File System: Unexpected new or modified files in the Jupyter working directory; new kernel sessions or terminal sessions created without corresponding user activity; unfamiliar .ipynb files with cells containing data-commandlinker-* HTML attributes or obfuscated JavaScript.
• Process: Unexpected child processes spawned from the Jupyter server process (e.g., shell commands executed via a newly created terminal session) (GitHub Advisory).

Patches are available in Jupyter Notebook 7.5.6 and JupyterLab 4.5.7 (and corresponding npm packages @jupyter-notebook/help-extension 7.5.6 and @jupyterlab/help-extension 4.5.7); upgrading is the recommended remediation. As an immediate workaround on unpatched systems, disable the affected help extensions via CLI:

jupyter labextension disable @jupyter-notebook/help-extension
jupyter labextension disable @jupyterlab/help-extension

Patched versions also include a hardening option to disable command linker functionality entirely by adding the following to overrides.json:

{
  "@jupyterlab/apputils-extension:sanitizer": {
    "allowCommandLinker": false
  }
}

Users should avoid opening notebook files from untrusted sources until systems are patched (GitHub Advisory, Jupyter Advisory).

The vulnerability was reported by Daniel Teixeira of the NVIDIA AI Red Team and coordinated by Jupyter maintainers (Carreau, Yann-P, krassowski, jtpio), reflecting responsible disclosure practices within the scientific computing community. OpenSUSE issued security announcements for affected packages, and Tenable published a Nessus detection plugin (ID 313260) shortly after disclosure. The Solus Linux distribution also noted the update in its weekly community digests, indicating broad downstream awareness (OpenSUSE Announce, Tenable).