# JupyterLab's command linker attributes in HTML enable one-click command execution from untrusted content

JupyterLab's sanitizer allowlisted data-commandlinker-* attributes on buttons, letting a notebook's stored HTML output execute arbitrary JupyterLab commands on one click.

- Payout: Research
- Severity: high
- Program: JupyterLab
- Found by: fg0x0
- Disclosed: 2026-05-06
- CVE: CVE-2026-42557
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-mqcg-5x36-vfcg
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-mqcg-5x36-vfcg
- Tags: area:web domain:web impact:dos impact:integrity impact:rce kind:research platform:ghsa sev:high tech:python technique:source-review vuln:rce vuln:xss

**Target:** JupyterLab/Notebook HTML sanitizer and CommandLinker click handler
**Root cause:** The HTML sanitizer allowlists `data-commandlinker-command` and `data-commandlinker-args` on `button` elements, while `CommandLinker` listens for all click events on `document.body` and executes the named command without verifying the element originated from trusted JupyterLab UI.
**Steps:**
1. Craft a notebook with a pre-saved HTML cell output containing a deceptive `button` carrying `data-commandlinker-command` (and optionally `data-commandlinker-args`) attributes.
2. Share the notebook or Markdown file via email, GitHub, or a Binder link.
3. Victim opens the notebook; the stored HTML output renders immediately without starting a kernel.
4. Victim clicks the button; the document.body click listener fires and CommandLinker executes the named JupyterLab command.
**Exploitation:** Attacker embeds a visually legitimate-looking button in stored HTML output; a single victim click invokes an arbitrary JupyterLab command such as executing code in available kernels, deleting files, or spawning many kernels/terminals to exhaust server resources. A multi-click variant (Chromium only) chains clipboard/keyboard access to reach the terminal and run arbitrary commands beyond kernel scope.
**Escalation:** Multi-click chain: ordered button clicks plus clipboard (or already-granted keyboard) access yields full terminal access and arbitrary commands with scope exceeding available kernels; third-party extensions expand the command surface.
**Insight:** Sanitizer allowlists and global event-delegation handlers are a dangerous pair: any attribute the sanitizer permits that a document-level listener acts on becomes an injection primitive. Audit allowlisted `data-*` attributes against listeners bound to `document.body`/`document` rather than the originating component.