CVE-2026-67338: Jupyterlab

Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days.

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the JupyterLab origin when users click the extension name.

Affected products

• Jupyterlab Jupyterlab: before 4.5.9 (fixed in 4.5.9)

Published 2026-08-01. Last modified 2026-10-08.