JupyterLab EUVD-2026-89338

Exploitation requires a specific non-default configuration: useSystemClipboardForCells must be active AND pasteCodeCellsWithoutOutput must be disabled. Under those settings the system-clipboard cell-paste path accepts attacker-controlled cell JSON without clearing metadata.trusted, so a pasted code cell can mark its HTML output as trusted, bypass output sanitization, and execute script in the authenticated JupyterLab origin - notably without executing the cell. Limiting factors: the victim must paste attacker-supplied clipboard content (UI:R), only code cells are affected (Markdown and raw cells are sanitized and immune), and the two-part non-default config gate meaningfully narrows real-world exposure below the raw 8.1 CVSS.

This is a network-exploitable stored/DOM XSS (CWE-79) in JupyterLab with a vendor CVSS 3.1 of 8.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N). The vector requires user interaction (UI:R - the victim must paste attacker-supplied content) but no privileges (PR:N) to stage the malicious clipboard payload. There is no public exploitation intelligence in the input: no EPSS score was supplied, the CVE is not in CISA KEV, and no standalone POC is referenced - the exploitation status is therefore 'no public exploit identified at time of analysis.' Note, however, that the fix commit (1a10a7da) ships a Jest regression test that fully demonstrates the technique (a code cell whose trusted HTML output runs window.__clipboardTrustPoc=1 via <script>), so the exploit mechanics are publicly documented even absent a weaponized tool. The high CVSS is tempered by two real limiters: exploitation depends on a NON-DEFAULT configuration (useSystemClipboardForCells active AND pasteCodeCellsWithoutOutput disabled) and on the victim performing a paste. This is a credible but conditional issue - real priority for environments that enable system-clipboard cell sharing, lower for default deployments. No signals conflict; the CVSS network vector and the description (clipboard paste in the browser) are consistent.

An attacker crafts cell JSON containing a code cell whose HTML output includes a script payload and sets metadata.trusted, then delivers it so the victim copies it to the system clipboard (e.g., via a shared notebook snippet or a web page). In a JupyterLab instance where useSystemClipboardForCells is enabled and pasteCodeCellsWithoutOutput is disabled, the victim pastes the cell and the trusted-marked HTML bypasses output sanitization, executing script in the authenticated JupyterLab origin without the cell ever being run. The fix commit's regression test demonstrates the exact technique, though no standalone public exploit tool is referenced.