JU
Vendor
jupyterlab
21
CVEs
0
On KEV
9
New 30D
Products
JU9.6
jupyterlab
jupyterlab
13 CVEs0 on KEV4 new
JU8.1
jupyterlite-core
jupyterlab
3 CVEs0 on KEV3 new
NO8.1
notebook
jupyterlab
2 CVEs0 on KEV2 new
JU9.0
jupyterlab-git
jupyterlab
2 CVEs0 on KEV0 new
HE8.4
help-extension
jupyterlab
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-102832 | NO notebook jupyterlab | 4.2 | Oct 13 | JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked |
| CVE-2026-102904 | JU jupyterlab jupyterlab | 5.4 | Sep 29 | JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs |
| CVE-2026-102831 | JU jupyterlite-core jupyterlab | 8.1 | Sep 29 | JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard |
| CVE-2026-102830 | JU jupyterlite-core jupyterlab | 6.8 | Sep 29 | JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json) |
| CVE-2026-73417 | JU jupyterlab jupyterlab | 8.6 | Aug 13 | JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`) |
| CVE-2026-73416 | JU jupyterlab jupyterlab | 6.1 | Aug 13 | jupyterlab: PyPI extension blocklist package-name canonicalization bypass |
| CVE-2026-73627 | JU jupyterlab jupyterlab | 6.0 | Aug 13 | JupyterLab 4.6.0 Plugin Manager Lock-Rule Enforcement Bypass |
| CVE-2026-73626 | JU jupyterlab jupyterlab | 7.5 | Aug 13 | JupyterLab before 4.6.2 Authentication Bypass via PyPIExtensionManager |
| CVE-2026-73415 | JU jupyterlab jupyterlab | 7.5 | Aug 12 | jupyterlab: Image viewer in JupyterLab allows XSS when opening malicious image in new browser tab |
| CVE-2026-67338 | JU jupyterlab jupyterlab | 6.1 | Aug 1 | JupyterLab before 4.5.9 Stored XSS via Extension Manager |
| CVE-2026-54528 | JU jupyterlab-git jupyterlab | 7.1 | Jul 8 | jupyterlab-git excluded_paths Case-Sensitivity Bypass Allows Reading Excluded Directories |
| CVE-2026-54527 | JU jupyterlab-git jupyterlab | 9.0 | Jul 8 | JupyterLab Git: Stored XSS leading to RCE |
| CVE-2026-42266 | JU jupyterlab jupyterlab | 8.8 | May 13 | JupyterLab has an Extension Manager API/GUI Policy Discrepancy allowing 3rd party (malicious) extensions install via POST request. |
| CVE-2026-42557 | JU jupyterlab jupyterlab | 9.6 | May 13 | jupyterlab: Command linker attributes in HTML enable one-click command execution from untrusted content |
| CVE-2026-40171 | JU jupyterlab jupyterlab | 8.4 | May 6 | Jupyter Notebook and JupyterLab token theft via stored XSS in help command linker |