PyPI/jupyterlite-core CVE-2026-102831: high 8.1, EPSS 0.19%

JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard

Action: Upgrade jupyterlite-core to 0.8.4 or later.

pip install jupyterlite-core==0.8.4

Affected

Fixed versions

Sources

• osv: PYSEC-2026-4060
• https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-6966-vjj6-99xv
• https://nvd.nist.gov/vuln/detail/CVE-2026-102831
• https://github.com/jupyterlab/jupyterlab/commit/1a10a7da5ff655849b21581c2633b46483ae0be9
• https://github.com/jupyterlab/jupyterlab/commit/7f9f29e29e0c83fb17b0f11da57d06b3c6a40d96
• https://github.com/jupyterlab/jupyterlab/commit/cf6e89a8d315c4134cefa50c220bca296da466a7
• https://github.com/jupyterlab/jupyterlab
• https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.11
• https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.4
• https://pypi.org/project/jupyterlite-core
• https://github.com/advisories/GHSA-6966-vjj6-99xv

CVE-2026-102831 · published 2026-10-01T16:44:34.455277Z · modified 2026-10-01T17:56:16.052628472Z · JSON