CVE-2026-67338
Fixed in a distro release EPSS <1%CVSS 6.1
JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the JupyterLab origin when users click the extension name.
Products: jupyterlab
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | jupyterlab | 4.5.9 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 13 | jupyterlab | no fix |
| Debian 14 | jupyterlab | 4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-4 |
| Ubuntu 26.04 LTS | jupyterlab | no fix |
| Ubuntu 26.10 | jupyterlab | no fix |