5.1
Medium
CVE-2026-67338 JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to…
Description
JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the JupyterLab origin when users click the extension name.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| jupyterlab 4.5 | earliest → < 4.5.9 | 4.5.9 |
References
- GitHub Security Advisory (GHSA-vmhf-c436-hxj4) github.com
- Patch Commit github.com
- Patch Commit github.com
- VulnCheck Advisory: JupyterLab before 4.5.9 Stored XSS via Extension Manager www.vulncheck.com
Timeline
- Published
- Last modified
Other CVEs of jupyterlab
The 18 CVEs of jupyterlab →
CVE-2026-102832
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook…
4.2
Medium
CVE-2026-102904
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook…
5.4
Medium
CVE-2026-102831
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook…
8.1
High
CVE-2026-102830
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook…
6.8
Medium