Login Request a demo
JU
Product
jupyterlab
by jupyterlab · last CVE Oct 13, 2026
17
CVEs
0
On KEV
9.6
Max CVSS
1
New 30D
Vulnerabilities17In the news0Timeline
Severity mix
Critical 1High 6Medium 10Low 0
Severity
All severities17Critical1High6Medium10Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add jupyterlab to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-102830
6.8
0%
Sep 29
JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)
Affected: >= 3.0.0, < 4.5.11; >= 4.6.0, < 4.6.4
CVE-2024-22421
6.5
1%
Jan 19
Potential authentication and CSRF tokens leak in JupyterLab
Affected: < 3.6.7; >=4.0.0,< 4.0.11
CVE-2026-73416
6.1
1%
Aug 13
jupyterlab: PyPI extension blocklist package-name canonicalization bypass
Affected: >= 4.5.0, < 4.5.10; >= 4.6.0, < 4.6.2
CVE-2026-67338
6.1
0%
Aug 1
JupyterLab before 4.5.9 Stored XSS via Extension Manager
Affected: before 4.5.9
CVE-2024-43805
6.1
0%
Aug 28
HTML injection in Jupyter Notebook and JupyterLab leading to DOM Clobbering
Affected: notebook: >= 7.0.0, <= 7.2.2; jupyterlab: >= 4.0.0, < 4.2.5; jupyterlab: < 3.6.8
CVE-2024-22420
6.1
1%
Jan 19
Stored cross site scripting in Markdown Preview in JupyterLab
Affected: >=4.0.0, < 4.0.11
CVE-2026-73627
6.0
0%
Aug 13
JupyterLab 4.6.0 Plugin Manager Lock-Rule Enforcement Bypass
Affected: 4.6.0 through 4.6.1; 4.1.0 through 4.5.9
CVE-2026-102904
5.4
0%
Sep 29
JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs
Affected: >= 4.0.0, < 4.5.11; >= 4.6.0, < 4.6.4
CVE-2025-59842
4.3
0%
Sep 26
JupyterLab LaTeX typesetter links did not enforce `noopener` attribute
Affected: < 4.4.8
CVE-2026-102832
4.2
0%
Oct 13
JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked
Affected: >= 4.5.7, < 4.5.11; >= 4.6.0, < 4.6.4
Showing 10