jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.7, JupyterLab's HTML sanitizer allowlists data-commandlinker-command and data-commandlinker-args on button elements, while CommandLinker listens for all click events on document.body and executes the named command without checking whether the element came from trusted JupyterLab UI. A notebook with a pre-saved HTML cell output containing a deceptive button can trigger arbitrary JupyterLab commands - including arbitrary code execution - on a single user click, without any code being submitted for execution by the user. This vulnerability is fixed in 4.5.7.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter     Notebook Architecture. Prior to 4.5.7, JupyterLab's HTML sanitizer allowlists data-commandlinker-command     and data-commandlinker-args on button elements, while CommandLinker listens for all click events on     document.body and executes the named command without checking whether the element came from trusted     JupyterLab UI. A notebook with a pre-saved HTML cell output containing a deceptive button can trigger     arbitrary JupyterLab commands - including arbitrary code execution - on a single user click, without any     code being submitted for execution by the user. This vulnerability is fixed in 4.5.7. (CVE-2026-42557)

Note that Nessus relies on the presence of the package as reported by the vendor.

Jupyter Notebook is an extensible environment for interactive and reproducible computing. The version of Jupyter Notebook installed on the remote host is 7.0.0 prior to 7.5.6. It is, therefore, affected by a vulnerability:

  - JupyterLab's command linker attributes in HTML enable one-click command execution from untrusted content.
    (CVE-2026-42557)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. The version of JupyterLab installed on the remote host is prior to 4.5.7. It is, therefore, affected by a vulnerability:

  - JupyterLab's command linker attributes in HTML enable one-click command execution from untrusted content.
    (CVE-2026-42557)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter
    Notebook Architecture. Prior to 4.5.7, JupyterLab's HTML sanitizer allowlists data-commandlinker-command
    and data-commandlinker-args on button elements, while CommandLinker listens for all click events on
    document.body and executes the named command without checking whether the element came from trusted
    JupyterLab UI. A notebook with a pre-saved HTML cell output containing a deceptive button can trigger
    arbitrary JupyterLab commands - including arbitrary code execution - on a single user click, without any
    code being submitted for execution by the user. This vulnerability is fixed in 4.5.7. (CVE-2026-42557)

ID	Name	Product	Family	Severity
314837	Linux Distros Unpatched Vulnerability : CVE-2026-42557	Nessus	Misc.	high
313226	Jupyter Notebook Python Library 7.0.0 < 7.5.6 (CVE-2026-42557)	Nessus	Misc.	high
313225	Jupyterlab Python Library < 4.5.7 (CVE-2026-42557)	Nessus	Misc.	high
441310	SCA: security update for jupyterlab, notebook (GHSA-mqcg-5x36-vfcg)	Tenable Cloud Security	SCA Checks	high
441310	SCA: security update for jupyterlab, notebook (GHSA-mqcg-5x36-vfcg)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2026-42557

high

Tenable Plugins

high

high

high

high

high