A low-risk (in practice, despite the Medium severity) JupyterLab vulnerability (CVE-2026-102832) is an example of a bug class every developer should recognize: time-of-check to time-of-use (TOCTOU). Credit to rexpository for reporting it, and to MUFFANUJ and krassowski for the fix and coordination. The flow: you click a button in a Markdown file or notebook, and JupyterLab asks whether to Cancel, Run Once, or Trust. You're deciding about the document you clicked in. But the code applies "Trust" to whichever document is current when you answer. If another document becomes current while the prompt is open, that one gets trusted instead, and the one you were reading stays untrusted. The app is checking for permission for one thing, but using that permission assuming "what's current" won't have changed. The lesson: when a user approves something, bind the approval to the exact object they saw, not to "whatever is current" later. That's what the fix does. The trust request now carries the document that was clicked, and the command runs only after that same document is marked. 🟢 Should you worry? Not much. It takes a notebook or Markdown file from someone else, a click, a Trust answer, and a second document becoming current at exactly the wrong moment. The advisory itself rates the complexity high and treats this as defense in depth. If you run JupyterLab: update to 4.5.11 or 4.6.4 (Notebook 7.6.3 and jupyterlite-core 0.8.4 carry the fix too). Until then, choose Run Once instead of Trust. If you write code with confirm prompts, approval dialogs, or async handlers: check what each one resolves at answer time. Read the full advisory: https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-jwrc-gm9j-263p #AppSec #SecureCoding #Jupyter