Stored Cross-Site Scripting Vulnerability in JupyterLab Extension Manager

CVE-2026-67338

What is CVE-2026-67338?

JupyterLab versions prior to 4.5.9 are susceptible to a stored cross-site scripting vulnerability within the Extension Manager. This security flaw arises from insufficient validation of URI protocols in package metadata URLs. As a result, attackers can create and publish malicious PyPI packages that contain 'javascript:' URLs in their project metadata. When users interact with these extensions, arbitrary JavaScript executes within the JupyterLab environment, leading to potential compromise of the user’s session and sensitive data. It is crucial for users to update to the latest version to mitigate this risk.

References