CVE-2026-67338

Name of the Vulnerable Software and Affected Versions JupyterLab versions prior to 4.5.9

Description A stored cross-site scripting issue exists in the Extension Manager due to a failure to validate URI protocols in package metadata URLs. An attacker can publish a malicious PyPI package containing a javascript: URL within the [project.urls] metadata. When a user clicks the extension name in the Extension Manager, the application renders the homepage url without validation, leading to the execution of arbitrary JavaScript in the JupyterLab origin.

Recommendations Update JupyterLab to version 4.5.9 or later.