Yann-P

**Name of the Vulnerable Software and Affected Versions** JupyterLab versions prior to 4.5.9 **Description** A stored cross-site scripting issue exists in the Extension Manager due to a failure to validate URI protocols in package metadata URLs. An attacker can publish a malicious PyPI package containing a `javascript:` URL within the `[project.urls]` metadata. When a user clicks the extension name in the Extension Manager, the application renders the `homepage url` without validation, leading to the execution of arbitrary JavaScript in the JupyterLab origin. **Recommendations** Update JupyterLab to version 4.5.9 or later.