Jupyterlab

This hub aggregates every CVE we track for Jupyterlab, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Jupyterlab.

• CVE-2026-73417JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)Aug 13, 2026
• CVE-2026-73416jupyterlab: PyPI extension blocklist package-name canonicalization bypassAug 13, 2026
• CVE-2026-73627JupyterLab 4.6.0 Plugin Manager Lock-Rule Enforcement BypassAug 13, 2026
• CVE-2026-73626JupyterLab before 4.6.2 Authentication Bypass via PyPIExtensionManager7.5Aug 13, 2026
• CVE-2026-73415jupyterlab: Image viewer in JupyterLab allows XSS when opening malicious image in new browser tabAug 12, 2026
• CVE-2026-67338JupyterLab before 4.5.9 Stored XSS via Extension Manager6.1Aug 1, 2026
• GHSA-pppj-hq3g-57pjJupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)Jul 22, 2026
• GHSA-gx64-gj6p-pc4cJupyterLab: Image viewer allows XSS when opening malicious image in new browser tabJul 22, 2026
• GHSA-89vp-jrxv-24w8JupyterLab: PyPI extension blocklist package-name canonicalization bypassJul 22, 2026
• GHSA-h5v5-8746-g7mmJupyterLab PluginManager lock-rule enforcement bypassJul 22, 2026
• GHSA-whvh-wf3x-g77jJupyterLab: Allowlist/blocklist check in `PyPIExtensionManager.install()` not enforced for direct callers (missing `await`)Jul 22, 2026
• GHSA-vmhf-c436-hxj4JupyterLab: Stored XSS in extension manager through package metadata unsanitized URI protocolJun 19, 2026
• CVE-2026-42266JupyterLab has an Extension Manager API/GUI Policy Discrepancy allowing 3rd party (malicious) extensions install via POST request.8.8May 13, 2026
• CVE-2026-42557jupyterlab: Command linker attributes in HTML enable one-click command execution from untrusted content9.6May 13, 2026
• CVE-2026-40171Jupyter Notebook and JupyterLab token theft via stored XSS in help command linkerMay 6, 2026