https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-05T06:19:53.751370+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-67338 CVE-2026-67338 — JupyterLab before 4.5.9 Stored XSS via Extension Manager 2026-10-05T06:19:53.753876+00:00

Affected: jupyterlab

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the JupyterLab origin when users click the extension name.