JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked

影響: pip:jupyterlab >= 4.6.0, <= 4.6.3 → 4.6.4, pip:jupyterlab >= 4.5.7, <= 4.5.10 → 4.5.11, pip:notebook >= 7.5.6, <= 7.6.2 → 7.6.3, pip:jupyterlite-core >= 0.7.5, <= 0.8.3 → 0.8.4

A Markdown file or a notebook output can carry a button that runs a JupyterLab command. Since 4.5.7 the first click on such a button opens a prompt naming the command, with Cancel, Run Once and Trust. Choosing Trust runs the command and marks the document trusted, so its later buttons run without a prompt. Which document gets marked is decided when the user answers, not when they click. Both trust commands read whichever document is current at that moment: markdownviewer:trust uses…

在 GitHub Advisory Database 阅读

2026/10/16 05:22，GitHub Advisory Database 发布了“JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked”（类型：漏洞公告）。严重程度为“中危”（medium）。相关技术：Python。CVE：CVE-2026-102832。