CVE-2026-67338
1 advisory.
PyPI/jupyterlab CVE-2026-67338: medium
JupyterLab: Stored XSS in extension manager through package metadata unsanitized URI protocol
Action: Upgrade jupyterlab to 4.5.9 or later.
pip install jupyterlab==4.5.9Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 4.5.9 | - |
Fixed versions
| 4.5.9 |
Sources
- osv: GHSA-vmhf-c436-hxj4
- https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-vmhf-c436-hxj4
- https://github.com/jupyterlab/jupyterlab/commit/4e61e07d0a91145b53fbf96ac74b0387f6bc51f6
- https://github.com/jupyterlab/jupyterlab/commit/d5d961f6e10a6442dddbf94d9a976b3897055a12
- https://github.com/jupyterlab/jupyterlab
- https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.9
CVE-2026-67338 · published · modified · JSON