Security Advisory

CVE-2026-67338

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-08-01 12:22:17

Last updated 2026-08-01 12:22:17

Assigner VulnCheck

CVSS score not scored

State PUBLISHED

Description

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the JupyterLab origin when users click the extension name.

← Browse all CVEs View on cve.org ↗