{"action":"Upgrade notebook to 7.5.6 or later.","affected":[{"fixed":"7.5.6","introduced":"7.0.0"}],"component":"notebook","cve_ids":["CVE-2026-42557"],"ecosystem":"PyPI","epss":0.00371,"exploited":false,"fixed_versions":["7.5.6"],"ghsa_id":"GHSA-mqcg-5x36-vfcg","id":"tcs_01M5KH0XG4N5BBCSTE4EZN2BNC","modified_at":"2026-07-13T16:43:04.081738235Z","published_at":"2026-07-13T15:15:39.814847Z","references":["https://osv.dev/vulnerability/PYSEC-2026-2681","https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-mqcg-5x36-vfcg","https://nvd.nist.gov/vuln/detail/CVE-2026-42557","https://github.com/jupyterlab/jupyterlab","https://jupyterlab.readthedocs.io/en/latest/user/commands.html#commands-in-markdown-files","https://pypi.org/project/notebook","https://github.com/advisories/GHSA-mqcg-5x36-vfcg"],"severity":{"label":"critical","score":9.6},"sources":[{"source":"osv","source_id":"PYSEC-2026-2681","url":"https://osv.dev/vulnerability/PYSEC-2026-2681"}],"summary":"JupyterLab's command linker attributes in HTML enable one-click command execution from untrusted content"}