Summary
A cell-paste handling flaw in JupyterLab, Notebook, and JupyterLite can preserve attacker-controlled trusted metadata in pasted code-cell JSON. Under specific clipboard settings, this may cause HTML output to bypass sanitization and execute script in an authenticated application origin without running the cell.
Affected context
The issue occurs in environments where:
- System clipboard support for cells is enabled
- Pasted cell content is accepted as attacker-controlled JSON
- Code-cell output is retained during paste
- The cell's
metadata.trustedvalue is not cleared before rendering
Markdown and raw cells are not affected by this specific path because their output is sanitized.
Exploit preconditions
- Attack surface: The system clipboard cell-paste workflow in JupyterLab, Notebook, or JupyterLite
- Required access: Ability to place or cause crafted cell JSON to be pasted by an authenticated user
- Trigger point: Pasting a code cell while system clipboard handling is active and code-cell output is retained
- Why exploitation is possible: Attacker-controlled trusted metadata can cause HTML output to bypass sanitization and execute in the authenticated application origin
Why this happens
The underlying bug is a failure to treat pasted cell metadata as untrusted input. The cell-paste path preserves metadata.trusted instead of clearing or re-evaluating it, allowing HTML output to be rendered under an unintended trust state.
This maps primarily to CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). It is also related to CWE-345: Insufficient Verification of Data Authenticity, because the application accepts trust-related metadata without adequately verifying its origin or authenticity.
Potential impact
- Script execution in the authenticated JupyterLab, Notebook, or JupyterLite origin
- Access to data and actions available through the affected user's session
- Account or workspace compromise where application permissions allow it
- Changes to notebooks, sessions, or other accessible computational resources
General mitigation guidance
Mitigation generally focuses on ensuring that pasted content is untrusted by default and that trust metadata is never accepted solely from attacker-controlled clipboard data.
Common defensive patterns include:
- Clearing or re-evaluating trust metadata whenever cells cross a trust boundary
- Sanitizing rendered HTML output regardless of attacker-supplied metadata
- Applying secure-by-default clipboard and rendering behavior
- Separating content authenticity decisions from client-provided cell JSON
- Limiting session and workspace privileges so rendered content has minimal access
- Using defense-in-depth browser and application security policies where practical
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis of clipboard and cell-import handlers for trust metadata propagation
- Code review checks ensuring untrusted content cannot mark output as trusted
- Tests that paste crafted code-cell JSON and verify that HTML output remains sanitized
- Policy checks requiring trust-state transitions to occur only after explicit verification
- Browser telemetry or content-security monitoring for unexpected script execution in notebook origins
Automated security review tools may help identify unsafe trust-boundary assumptions, but behavioral tests are important for validating rendering and sanitization paths.
