Login Request a demo
JU
Product
jupyterlab
by jupyterlab · last CVE Oct 13, 2026
13
CVEs
0
On KEV
9.6
Max CVSS
4
New 30D
Vulnerabilities13In the news0Timeline
Severity mix
Critical 1High 6Medium 6Low 0
Severity
All severities13Critical1High6Medium6Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add jupyterlab to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-42557
9.6
0%
May 13
jupyterlab: Command linker attributes in HTML enable one-click command execution from untrusted content
Affected: < 4.5.7
CVE-2026-42266
8.8
6%
May 13
JupyterLab has an Extension Manager API/GUI Policy Discrepancy allowing 3rd party (malicious) extensions install via POST request.
Affected: >= 4.0.0, < 4.5.7
CVE-2026-73417
8.6
1%
Aug 13
JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)
Affected: >= 3.3.0, < 4.5.10; >= 4.6.0, < 4.6.2
CVE-2026-40171
8.4
0%
May 6
Jupyter Notebook and JupyterLab token theft via stored XSS in help command linker
Affected: <= 4.5.6
CVE-2026-102831
8.1
0%
Sep 29
JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard
Affected: >= 4.5.0, < 4.5.11; >= 4.6.0, < 4.6.4
CVE-2026-73626
7.5
0%
Aug 13
JupyterLab before 4.6.2 Authentication Bypass via PyPIExtensionManager
Affected: 4.6.0 before 4.6.1; before 4.5.10
CVE-2026-73415
7.5
1%
Aug 12
jupyterlab: Image viewer in JupyterLab allows XSS when opening malicious image in new browser tab
Affected: < 4.5.10; >= 4.6.0, < 4.6.2
CVE-2026-102830
6.8
0%
Sep 29
JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)
Affected: >= 3.0.0, < 4.5.11; >= 4.6.0, < 4.6.4
CVE-2026-73416
6.1
1%
Aug 13
jupyterlab: PyPI extension blocklist package-name canonicalization bypass
Affected: >= 4.5.0, < 4.5.10; >= 4.6.0, < 4.6.2
CVE-2026-67338
6.1
0%
Aug 1
JupyterLab before 4.5.9 Stored XSS via Extension Manager
Affected: before 4.5.9
CVE-2026-73627
6.0
0%
Aug 13
JupyterLab 4.6.0 Plugin Manager Lock-Rule Enforcement Bypass
Affected: 4.6.0 through 4.6.1; 4.1.0 through 4.5.9
CVE-2026-102904
5.4
0%
Sep 29
JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs
Affected: >= 4.0.0, < 4.5.11; >= 4.6.0, < 4.6.4
CVE-2026-102832
4.2
0%
Oct 13
JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked
Affected: >= 4.5.7, < 4.5.11; >= 4.6.0, < 4.6.4
Showing 13