CVE-2026-67338 Details
Description
JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the JupyterLab origin when users click the extension name.
A stored cross-site scripting vulnerability has been identified in JupyterLab versions prior to 4.5.9. The issue resides in the Extension Manager, which does not properly validate URI protocols in package metadata URLs. This flaw allows attackers to publish malicious PyPI packages containing 'javascript:' URLs in the project metadata. When users click on the extension name, the embedded JavaScript executes in the JupyterLab origin, potentially leading to unauthorized actions or data exposure.
Users can update to JupyterLab version 4.5.9 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-84 | Improper Neutralization of Encoded URI Schemes in a Web Page | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 3, 2026 | CVE Modified | CISA-ADP |
| Aug 1, 2026 | New CVE Received | [email protected] |