What’s Vulnerable › Products
jupyterlab vulnerabilities
19 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 14 published in the last 12 months.
Check whether your jupyterlab version is affected
Latest jupyterlab vulnerabilities
- CVE-2026-102832 — JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked (CVSS 4.2)
- CVE-2026-102904 — JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs (CVSS 5.4)
- CVE-2026-102831 — JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard (CVSS 8.1)
- CVE-2026-102830 — JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json) (CVSS 6.8)
- CVE-2026-73417 — JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`) (CVSS 8.6)
- CVE-2026-73416 — jupyterlab: PyPI extension blocklist package-name canonicalization bypass (CVSS 6.1)
- CVE-2026-73627 — JupyterLab 4.6.0 Plugin Manager Lock-Rule Enforcement Bypass (CVSS 6.0)
- CVE-2026-73626 — JupyterLab before 4.6.2 Authentication Bypass via PyPIExtensionManager (CVSS 7.5)
- CVE-2026-73415 — jupyterlab: Image viewer in JupyterLab allows XSS when opening malicious image in new browser tab (CVSS 7.5)
- CVE-2026-67338 — JupyterLab before 4.5.9 Stored XSS via Extension Manager (CVSS 6.1)
- CVE-2026-42557 — jupyterlab: Command linker attributes in HTML enable one-click command execution from untrusted content (CVSS 9.6)
- CVE-2026-42266 — JupyterLab has an Extension Manager API/GUI Policy Discrepancy allowing 3rd party (malicious) extensions install via POST request. (CVSS 8.8)
- CVE-2026-40171 — Jupyter Notebook and JupyterLab token theft via stored XSS in help command linker (CVSS 8.4)
- CVE-2025-59842 — JupyterLab LaTeX typesetter links did not enforce `noopener` attribute (CVSS 4.3)
- CVE-2024-43805 — HTML injection in Jupyter Notebook and JupyterLab leading to DOM Clobbering (CVSS 6.1)
- CVE-2024-39700 — Remote Code Execution (RCE) vulnerability in jupyterlab extension template `update-integration-tests` GitHub Action (CVSS 9.8)
- CVE-2024-22421 — Potential authentication and CSRF tokens leak in JupyterLab (CVSS 6.5)
- CVE-2024-22420 — Stored cross site scripting in Markdown Preview in JupyterLab (CVSS 6.1)
- CVE-2021-32797 — JupyterLab: XSS due to lack of sanitization of the action attribute of an html <form> (CVSS 9.6)