AIKIDO-2026-811821
jupyterlab is vulnerable to Cross-Site Scripting (XSS)
61
CVE Score
Medium
Cross-Site Scripting (XSS)
TL;DR
The JupyterLab Extension Manager renders a package's home-page link from PyPI project metadata without validating the URI protocol. A package published with a javascript: URL in its metadata is copied into the frontend link and stored, so viewing the extension listing and clicking the extension name runs the embedded script in the JupyterLab origin. This stored cross-site scripting can be escalated to code execution through the notebook server and connected kernels. The fix validates and neutralizes non-safe URI protocols before the link is rendered.
How do I fix this?
Upgrade the jupyterlab library to the patch version.
Who does this affect?
You are affected if you run an affected jupyterlab version with the Extension Manager enabled against the default PyPI source, and you open the extension listing and click the name of an untrusted package whose PyPI project metadata carries a javascript: home-page URL.
Package
Versions
0.34.0 - 4.5.8
Fixed in 4.5.9Background info
jupyterlab is vulnerable to Cross-Site Scripting (XSS) in versions 0.34.0 - 4.5.8.
Links
GitHub Release
Fix Commits
github.com/jupyterlab/jupyterlab/commit/4e61e07d0a91145b53fbf96ac74b0387f6bc51f6github.com/jupyterlab/jupyterlab/commit/d5d961f6e10a6442dddbf94d9a976b3897055a12
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.