5.1
Moyenne
CVE-2026-67338 JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to…
Description
JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the JupyterLab origin when users click the extension name.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| jupyterlab 4.5 | premières → < 4.5.9 | 4.5.9 |
Références
- GitHub Security Advisory (GHSA-vmhf-c436-hxj4) github.com
- Patch Commit github.com
- Patch Commit github.com
- VulnCheck Advisory: JupyterLab before 4.5.9 Stored XSS via Extension Manager www.vulncheck.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de jupyterlab
Les 18 CVE de jupyterlab →
CVE-2026-102832
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook…
4.2
Moyenne
CVE-2026-102904
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook…
5.4
Moyenne
CVE-2026-102831
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook…
8.1
Élevée
CVE-2026-102830
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook…
6.8
Moyenne