Jupyterlab vulnerabilities

CVE-2026-42557 [CRITICAL] CWE-79 CVE-2026-42557: jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jup jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.7, JupyterLab's HTML sanitizer allowlists data-commandlinker-command and data-commandlinker-args on button elements, while CommandLinker listens for all click events on document.body and executes the named com

CVE-2021-32797 [CRITICAL] CWE-79 CVE-2021-32797: JupyterLab is a user interface for Project Jupyter which will eventually replace the classic Jupyter JupyterLab is a user interface for Project Jupyter which will eventually replace the classic Jupyter Notebook. In affected versions untrusted notebook can execute code on load. In particular JupyterLab doesn’t sanitize the action attribute of html ``. Using this it is possible to trigger the form validation outside of the form itself. This is a rem

CVE-2026-42266 [HIGH] CWE-88 CVE-2026-42266: JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jup JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.0.0 to 4.5.6, the allow-list of extensions that can be installed from PyPI Extension Manager (allowed_extensions_uris) is not correctly enforced by JupyterLab. The PyPI Extension Manager was not contained to packages li

CVE-2026-40171 [HIGH] CWE-79 CVE-2026-40171: In Jupyter Notebook versions 7.0.0 through 7.5.5, JupyterLab versions 4.5.6 and earlier, and the cor In Jupyter Notebook versions 7.0.0 through 7.5.5, JupyterLab versions 4.5.6 and earlier, and the corresponding @jupyter-notebook/help-extension and @jupyterlab/help-extension packages before 7.5.6 and 4.5.7, a stored cross-site scripting issue in the help command linker can be chained with attacker-controlled notebook content to steal authentication to

CVE-2024-22421 [MEDIUM] CWE-23 CVE-2024-22421: JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jup JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. Users of JupyterLab who click on a malicious link may get their `Authorization` and `XSRFToken` tokens exposed to a third party when running an older `jupyter-server` version. JupyterLab versions 4.1.0b2, 4.0.11, and 3.6

CVE-2024-22420 [MEDIUM] CWE-79 CVE-2024-22420: JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jup JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. This vulnerability depends on user interaction by opening a malicious Markdown file using JupyterLab preview feature. A malicious user can access any data that the attacked user has access to as well as perform arbitrary

CVE-2024-43805 [MEDIUM] CWE-79 CVE-2024-43805: jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jup jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. This vulnerability depends on user interaction by opening a malicious notebook with Markdown cells, or Markdown file using JupyterLab preview feature. A malicious user can access any data that the attacked user has access to

CVE-2026-67338 [MEDIUM] CWE-84 CVE-2026-67338: JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manage JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the JupyterLab origin when users click the extension name.

CVE-2025-59842 [MEDIUM] CWE-1022 CVE-2025-59842: jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jup jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to version 4.4.8, links generated with LaTeX typesetters in Markdown files and Markdown cells in JupyterLab and Jupyter Notebook did not include the noopener attribute. This is deemed to have no impact on the default