| JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clickedCVE-2026-102832 · GHSA-JWRC-GM9J-263P |
jupyterlabjupyterlite-core |
PyPIRed Hat |
Medium
|
Fix reported |
|
| JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLsCVE-2026-102904 · GHSA-3325-V43H-43RVVersion ranges need review. |
jupyterlabMigration Toolkit for Applications 8/mta/mta-solution-server-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboardCVE-2026-102831 · GHSA-6966-VJJ6-99XVVersion ranges need review. |
jupyterlabjupyterlite-core |
PyPIRed Hat |
High
|
Fix reported |
|
| JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)CVE-2026-102830 · GHSA-3JQQ-PW4J-PQCJVersion ranges need review. |
jupyterlabjupyterlite-core |
PyPIRed Hat |
Medium
|
Fix reported |
|
| JupyterLab: PyPI extension blocklist package-name canonicalization bypassCVE-2026-73416 · GHSA-89VP-JRXV-24W8Version ranges need review. |
jupyterlabMigration Toolkit for Applications 8/mta/mta-solution-server-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| JupyterLab: Image viewer allows XSS when opening malicious image in new browser tabCVE-2026-73415 · GHSA-GX64-GJ6P-PC4CVersion ranges need review. |
jupyterlabRed Hat OpenShift AI (RHOAI)/rhoai/odh-th06-cpu-torch291-py312-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)CVE-2026-73417 · GHSA-PPPJ-HQ3G-57PJVersion ranges need review. |
jupyterlabRed Hat OpenShift AI (RHOAI)/rhoai/odh-th06-cpu-torch291-py312-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| JupyterLab PluginManager lock-rule enforcement bypassGHSA-H5V5-8746-G7MM |
jupyterlab |
PyPI |
Medium
|
Fix reported |
|
| JupyterLab: Allowlist/blocklist check in `PyPIExtensionManager.install()` not enforced for direct callers (missing `await`)GHSA-WHVH-WF3X-G77J |
jupyterlab |
PyPI |
Low
|
Fix reported |
|
| JupyterLab vulnerable to SXSS in Markdown PreviewCVE-2024-22420 · GHSA-4M77-CMPX-VJC4Version ranges need review. |
jupyterlabnotebook |
PyPI |
Medium
|
Fix reported |
|
| HTML injection in Jupyter Notebook and JupyterLab leading to DOM ClobberingCVE-2024-43805 · GHSA-9Q39-RMJ3-P4R2Version ranges need review. |
jupyterlabnotebook |
PyPI |
High
|
Fix reported |
|
| JupyterLab's command linker attributes in HTML enable one-click command execution from untrusted contentCVE-2026-42557 · GHSA-MQCG-5X36-VFCGVersion ranges need review. |
jupyterlabnotebook |
PyPIRed Hat |
High
|
Fix reported |
|
| JupyterLab vulnerable to potential authentication and CSRF tokens leakCVE-2024-22421 · GHSA-44CC-43RP-5947Version ranges need review. |
jupyterlabnotebook |
PyPI |
High
|
Fix reported |
|
| Jupyter Notebook Vulnerable to Authentication Token Theft via CommandLinker XSSCVE-2026-40171 · GHSA-RCH3-82JR-F9W9Version ranges need review. |
@jupyter-notebook/help-extension@jupyterlab/help-extension |
npmPyPI |
High
|
Fix reported |
|
| PYSEC-2024-322CVE-2024-39700 · GHSA-45GQ-V5WM-82WG |
jupyterlab |
PyPI |
Critical
|
Fix reported |
|
| JupyterLab LaTeX typesetter links did not enforce `noopener` attributeCVE-2025-59842 · GHSA-VVFJ-2JQX-52JMVersion ranges need review. |
jupyterlabRed Hat OpenShift AI (RHOAI)/rhoai/odh-kf-notebook-controller-rhel8 |
PyPIRed Hat |
Low
|
Fix reported |
|
| JupyterLab: XSS due to lack of sanitization of the action attribute of an html <form>CVE-2021-32797 · GHSA-4952-P58Q-6CRXVersion ranges need review. |
jupyterlabnotebook |
PyPI |
Medium
|
Fix reported |
|
| JupyterLab: Stored XSS in extension manager through package metadata unsanitized URI protocolGHSA-VMHF-C436-HXJ4 |
jupyterlab |
PyPI |
Medium
|
Fix reported |
|
| JupyterLab has an Extension Manager API/GUI Policy Discrepancy, allowing 3rd party (malicious) extensions install via POST requestCVE-2026-42266 · GHSA-37W4-HWHX-4RC4Version ranges need review. |
jupyterlabRed Hat OpenShift AI (RHOAI)/rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
