CVE-2026-102832

Executive Summary

CVE-2026-102832 is a time-of-check time-of-use (TOCTOU) vulnerability in JupyterLab's markdownviewer:trust and notebook:trust command-link handlers. When a user clicks a Trust command button and a different document becomes the active widget before the confirmation prompt is answered, JupyterLab applies the trust decision to the newly current document rather than the document whose button was clicked. This causes the wrong document to be marked trusted, enabling subsequent command buttons in that document to execute without prompts, and for notebooks, marking all cells trusted, saving unsaved edits, and persisting the server signature to disk.

Technical Analysis

The vulnerability resides in the trust-prompt workflow for command-link handlers markdownviewer:trust and notebook:trust. Per the NVD description, these handlers resolve the target document using tracker.currentWidget at the time the user answers the trust prompt, instead of retaining a reference to the specific document whose command button initiated the prompt. This is a classic CWE-367 (Time-of-Check Time-of-Use) race condition: the document identity is resolved ("checked") after an asynchronous user interaction, while the trust decision is applied ("used") against whatever widget is current at that later moment.

The attack surface is the command-link mechanism inside rendered markdown and notebooks within the JupyterLab web application. The vulnerable condition requires:

1. A user clicks a Trust command button rendered in a document (markdown viewer or notebook).
2. A trust confirmation prompt opens.
3. While the prompt is open, another document becomes the current widget (e.g., the user navigates to or focuses a different notebook/markdown file).
4. The user answers "Trust."

Because the handler resolves the target via tracker.currentWidget at step 4, the trust is applied to the second, now-current document, while the originally clicked document remains untrusted.

No code beyond the symbols named in the NVD description (markdownviewer:trust, notebook:trust, tracker.currentWidget) should be assumed. The precise internal implementation is not disclosed; the mechanism above is directly derivable from the description. Applications bundling JupyterLab, including affected Notebook and JupyterLite releases, inherit the behavior.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available (POC_STATUS: None). The chain below is inferred strictly from the vulnerability class (TOCTOU / CWE-367) and the behavior described in the NVD entry.

1. Reconnaissance / target identification. An attacker identifies a JupyterLab deployment (self-hosted or a bundled Notebook/JupyterLite application) running an affected version (4.5.7–4.5.10 or 4.6.0–4.6.3). The attacker must be able to influence document content that a victim will open — for example, by supplying a crafted notebook or markdown file through a shared repository, collaborative session, or untrusted content source.

2. Triggering the flaw class. The crafted document contains a Trust command button. When the victim clicks it, the trust confirmation prompt opens. The attacker induces a context switch so that a second document becomes the current widget while the prompt is still open (for example, by the victim navigating to another notebook). The victim then confirms "Trust."

3. Payload / execution method. The notebook:trust / markdownviewer:trust handler resolves tracker.currentWidget at answer time and marks the second document trusted. The clicked document remains untrusted. Because the second document is now incorrectly trusted, later command buttons embedded in that document run without displaying a trust prompt.

4. Post-exploitation impact. In a notebook, trusting it marks all cells trusted, saves unsaved edits, and persists the server signature to disk. The persistence of the trust signature to disk means the incorrectly trusted state can outlive the session. The incorrectly trusted document subsequently executes command buttons without prompting, which — combined with the fact that trusting a notebook marks all cells trusted — broadens the set of code that can run without an explicit user trust decision.

The CVSS vector (AV:N / AC:H / PR:N / UI:R / S:U / C:L / I:L / A:N, score 4.2) reflects that exploitation requires network access, high attack complexity (a race/timing condition), no privileges, and user interaction, with limited confidentiality and integrity impact and no availability impact.

Impact Assessment

The impact is a trust-boundary bypass within the JupyterLab client. A document the user did not intend to trust becomes trusted, and command buttons within it then execute without a prompt. For notebooks, the trust action marks all cells trusted, saves unsaved edits, and persists the server signature to disk, so the erroneously trusted state is durable. CVSS subscores:

• Confidentiality: Low (C:L) — incorrectly trusted content may expose or act on data it otherwise could not.
• Integrity: Low (I:L) — unsaved edits are saved and a trust signature is written to disk without the user's intended authorization.
• Availability: None (A:N).
• Scope: Unchanged (S:U) — the impact remains within the JupyterLab trust model.

Blast radius: any JupyterLab deployment in affected versions, plus applications that bundle it (affected Notebook and JupyterLite releases), which inherit the behavior. Because trust is a security control protecting users from executing untrusted notebook/markdown content, its bypass weakens a primary defense-in-depth control in JupyterLab. Exploitation requires a race condition and user interaction, limiting real-world reliability, but the persistence of the server signature amplifies the consequence once the race is won.

Detection Guidance

Sigma Rule

title: JupyterLab Trust Handler TOCTOU - Suspicious Trust Command Invocation
id: 3b0f9c2a-7d41-4e8b-9f1a-6c2d5e8a0b77
status: experimental
description: Detects JupyterLab trust command-link activity consistent with CVE-2026-102832 TOCTOU abuse
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102832
author: valtersit.com
date: 2026/01/01
logsource:
  product: webserver
  service: jupyterlab
detection:
  selection_trust:
    cs-uri-query|contains:
      - 'notebook:trust'
      - 'markdownviewer:trust'
  selection_trust_api:
    cs-uri-stem|contains:
      - '/api/contents'
      - '/api/trust'
  condition: selection_trust or selection_trust_api
falsepositives:
  - Legitimate trust confirmations by users on their own documents
level: low
tags:
  - attack.t1204
  - cwe.367

YARA Rule

rule CVE_2026_102832_JupyterLab_Trust_TOCTOU
{
    meta:
        description = "Detects JupyterLab trust handler references associated with CVE-2026-102832"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102832"
        author = "valtersit.com"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $s1 = "markdownviewer:trust" ascii wide
        $s2 = "notebook:trust" ascii wide
        $s3 = "tracker.currentWidget" ascii wide
        $t1 = "currentWidget" ascii wide

    condition:
        (uint16(0) == 0x4B50 or uint32(0) == 0x04034b50) and
        (any of ($s1, $s2)) and $t1
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-102832 JupyterLab Trust Handler TOCTOU Reference"; flow:to_server,established; http.uri; content:"notebook:trust"; nocase; http.uri; content:"markdownviewer:trust"; nocase; classtype:attempted-user; reference:cve,2026-102832; sid:2026102832; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ network where network.protocol == "http" and url.path contains "notebook:trust" ]
  [ network where network.protocol == "http" and url.path contains "/api/contents" ]

Splunk SPL Query

index=web OR index=jupyter sourcetype=access_combined
| search uri="*notebook:trust*" OR uri="*markdownviewer:trust*" OR uri="*/api/trust*"
| stats count, values(uri) as uris, values(src_ip) as src_ips by user, host
| where count > 1
| table user host count src_ips uris

Wazuh OSSEC Rule

<group name="jupyterlab,cve-2026-102832,">
  <rule id="2026103" level="3">
    <decoded_as>json</decoded_as>
    <field name="url">notebook:trust</field>
    <description>CVE-2026-102832: JupyterLab notebook trust command requested</description>
  </rule>
  <rule id="2026104" level="3">
    <decoded_as>json</decoded_as>
    <field name="url">markdownviewer:trust</field>
    <description>CVE-2026-102832: JupyterLab markdown viewer trust command requested</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Per the NVD description, the issue is fixed in JupyterLab 4.5.11 and 4.6.4; however, no vendor advisory or patch source is currently tracked, so this must be independently verified before relying on it.

1. Immediate mitigations. Restrict who can introduce notebooks/markdown content into the environment that other users will open. Avoid clicking Trust command buttons in documents of uncertain provenance, and avoid switching the active document (navigating to another notebook or markdown file) while a trust confirmation prompt is open. Limit JupyterLab exposure (no direct internet-facing deployments) and enforce strong authentication. Applications that bundle JupyterLab (affected Notebook and JupyterLite releases) inherit the behavior and require the same caution.

2. Patch / upgrade steps. Upgrade to JupyterLab 4.5.11 or 4.6.4 (or later), as specified in the NVD description. For bundled applications, upgrade the underlying JupyterLab dependency to a fixed release, or upgrade the affected Notebook/JupyterLite distributions once they incorporate the fixed JupyterLab version. Confirm the resolved version in each environment.

3. Long-term hardening. Treat notebook trust as a security control and audit workflows that rely on it. Remove the ability to silently persist trust signatures to disk for documents not explicitly authorized. Monitor for command-button execution that occurs without an interactive trust prompt. Keep JupyterLab, Notebook, and JupyterLite current, and apply a policy that untrusted notebooks/markdown authored externally are never opened in privileged server contexts. Given the TOCTOU nature, ensure that trust decisions bind to the specific document that initiated the prompt, verified in any custom integrations.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102832
• JupyterLab project security advisories: https://github.com/jupyterlab/jupyterlab/security/advisories
• CWE-367 (Time-of-Check Time-of-Use Race Condition): https://cwe.mitre.org/data/definitions/367.html
• Jupyter security documentation: https://jupyter.org/security
• CISA KEV catalog (no entry for this CVE): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or exploit-in-the-wild evidence is associated with this CVE. No public PoC, exploit code, or Nuclei template is available. EPSS has not yet been scored by FIRST.org.