CVE-2026-84973: GHSL-2026-203: Same-second TOCTOU vulnerability in jupyterlab/maintainer-tools update-snapshots-checkout - CVE-2026-84973
The jupyterlab/maintainer-tools update-snapshots-checkout action uses one-second timestamps to reject pull request updates after an authorized comment. An attacker can win a same-second race, causing a privileged workflow to check out and execute attacker-controlled code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
jupyterlab/maintainer-tools update-snapshots-checkoutto a version that resolves this vulnerability.Patch GHSL-2026-203 - Configuration
Change the action logic to not rely on one-second timestamps for rejecting pull request updates after an authorized comment to mitigate the same-second TOCTOU race described in GHSL-2026-203 / CVE-2026-84973.
jupyterlab/maintainer-tools update-snapshots-checkout timestamp resolution used to reject same-PR updates = not 1-second (avoid same-second TOCTOU)
Event History
Frequently Asked Questions
Who is exposed to this issue?
Repositories using the jupyterlab/maintainer-tools/update-snapshots-checkout action are exposed when a privileged workflow relies on an authorized comment to approve execution of pull request code.
What must an attacker do to exploit it?
The attacker must update a pull request in the same one-second timestamp window as an authorized comment. Winning that race can cause the privileged workflow to check out and execute attacker-controlled code.
Are repositories using this action safe by default?
The provided information does not establish whether a default configuration is affected. Exposure depends on use of the action in a privileged workflow that authorizes execution through comments.