CVE-2026-102832: JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked

A Markdown file or a notebook output can carry a button that runs a JupyterLab command. Since 4.5.7 the first click on such a button opens a prompt naming the command, with Cancel, Run Once and Trust. Choosing Trust runs the command and marks the document trusted, so its later buttons run without a prompt.

Which document gets marked is decided when the user answers, not when they click. Both trust commands read whichever document is current at that moment: markdownviewer:trust uses tracker.currentWidget, and notebook:trust uses the equivalent lookup. If another document becomes current while the prompt is open, that document is the one marked trusted, and the one the user was looking at stays untrusted.

Users are affected if all of the following are true:

• they run JupyterLab 4.5.7 through 4.6.3, or an application that bundles it such as Notebook 7.5+;
• they open a Markdown file or notebook from someone else and click a button in it;
• they answer Trust rather than Cancel or Run Once; and
• a second document becomes the current one while the prompt is open, for example through a workspace restoring at startup, an extension activating a widget, or a command that opens a file