JupyterLab Desktop: malicious Connect-to-server URL → XSS → RCE (GHSA-vrj4 / CVE-2026-102530 family) — upgrade to 4.6.2-1
- Do now: upgrade JupyterLab Desktop to 4.6.2-1 or later on every analyst laptop; inventory older per-user installs that missed the July security release.
- Only connect to remote Jupyter URLs you obtained out-of-band from a trusted operator.
- Related: GHSA-2mr8-962v-wc67 (token leak → RCE) also fixed in 4.6.2-1; macOS TCC bypass pair is medium and needs local code exec first.
Sources: GHSA-vrj4-r4fw-9rfh: malicious server URL → XSS → RCE · GHSA-2mr8-962v-wc67: one-click server token leak → RCE · JupyterLab Desktop v4.6.2-1 release