Jupyterlab Jupyterlite-Core vulnerabilities

CVE-2026-102831 [HIGH] CWE-79 CVE-2026-102831: JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jup JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.5.0 until 4.5.11 and 4.6.4, from Notebook 7.5.0 until 7.6.3, and from JupyterLite Core 0.7.0 until 0.8.4, the system clipboard cell-paste path accepts attacker-controlled cell JSON without clearing metadata

CVE-2026-102830 [MEDIUM] CWE-79 CVE-2026-102830: JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jup JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 3.0.0 until 4.5.11 and 4.6.4, and in JupyterLite Core 0.8.3 and earlier, the Plural-Forms header in a selected third-party language pack can append JavaScript after a valid plural rule because prefix-only r

CVE-2026-102832 [MEDIUM] CWE-367 CVE-2026-102832: JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jup JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.7 until 4.5.11 and 4.6.4, the markdownviewer:trust and notebook:trust command-link handlers use tracker.currentWidget to resolve the current Markdown viewer or notebook when the user answers rather than retaining