JU
Vendor
jupyterlab
27
CVEs
0
On KEV
3
New 30D
Products
JU9.6
jupyterlab
jupyterlab
17 CVEs0 on KEV1 new
JU8.1
jupyterlite-core
jupyterlab
3 CVEs0 on KEV1 new
NO8.1
notebook
jupyterlab
2 CVEs0 on KEV1 new
JU9.0
jupyterlab-git
jupyterlab
3 CVEs0 on KEV0 new
EX9.8
extension-template
jupyterlab
1 CVEs0 on KEV0 new
HE8.4
help-extension
jupyterlab
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-102832 | NO notebook jupyterlab | 4.2 | Oct 13 | JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked |
| CVE-2026-102904 | JU jupyterlab jupyterlab | 5.4 | Sep 29 | JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs |
| CVE-2026-102831 | NO notebook jupyterlab | 8.1 | Sep 29 | JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard |
| CVE-2026-102830 | JU jupyterlite-core jupyterlab | 6.8 | Sep 29 | JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json) |
| CVE-2026-73417 | JU jupyterlab jupyterlab | 8.6 | Aug 13 | JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`) |
| CVE-2026-73416 | JU jupyterlab jupyterlab | 6.1 | Aug 13 | jupyterlab: PyPI extension blocklist package-name canonicalization bypass |
| CVE-2026-73627 | JU jupyterlab jupyterlab | 6.0 | Aug 13 | JupyterLab 4.6.0 Plugin Manager Lock-Rule Enforcement Bypass |
| CVE-2026-73626 | JU jupyterlab jupyterlab | 7.5 | Aug 13 | JupyterLab before 4.6.2 Authentication Bypass via PyPIExtensionManager |
| CVE-2026-73415 | JU jupyterlab jupyterlab | 7.5 | Aug 12 | jupyterlab: Image viewer in JupyterLab allows XSS when opening malicious image in new browser tab |
| CVE-2026-67338 | JU jupyterlab jupyterlab | 6.1 | Aug 1 | JupyterLab before 4.5.9 Stored XSS via Extension Manager |
| CVE-2026-54528 | JU jupyterlab-git jupyterlab | 7.1 | Jul 8 | jupyterlab-git excluded_paths Case-Sensitivity Bypass Allows Reading Excluded Directories |
| CVE-2026-54527 | JU jupyterlab-git jupyterlab | 9.0 | Jul 8 | JupyterLab Git: Stored XSS leading to RCE |
| CVE-2026-42266 | JU jupyterlab jupyterlab | 8.8 | May 13 | JupyterLab has an Extension Manager API/GUI Policy Discrepancy allowing 3rd party (malicious) extensions install via POST request. |
| CVE-2026-42557 | JU jupyterlab jupyterlab | 9.6 | May 13 | jupyterlab: Command linker attributes in HTML enable one-click command execution from untrusted content |
| CVE-2026-40171 | HE help-extension jupyterlab | 8.4 | May 6 | Jupyter Notebook and JupyterLab token theft via stored XSS in help command linker |
| CVE-2025-59842 | JU jupyterlab jupyterlab | 4.3 | Sep 26 | JupyterLab LaTeX typesetter links did not enforce `noopener` attribute |
| CVE-2025-30370 | JU jupyterlab-git jupyterlab | 7.4 | Apr 3 | jupyterlab-git has a command injection vulnerability in "Open Git Repository in Terminal" |
| CVE-2024-43805 | JU jupyterlab jupyterlab | 6.1 | Aug 28 | HTML injection in Jupyter Notebook and JupyterLab leading to DOM Clobbering |
| CVE-2024-39700 | EX extension-template jupyterlab | 9.8 | Jul 16 | Remote Code Execution (RCE) vulnerability in jupyterlab extension template `update-integration-tests` GitHub Action |
| CVE-2024-22420 | JU jupyterlab jupyterlab | 6.1 | Jan 19 | Stored cross site scripting in Markdown Preview in JupyterLab |
| CVE-2024-22421 | JU jupyterlab jupyterlab | 6.5 | Jan 19 | Potential authentication and CSRF tokens leak in JupyterLab |