PyPIPackage

jupyterlab

19 known vulnerabilities (1 critical, 10 high, 7 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release: 4.6.6 (Nov 6, 2026): no advisory affects it
Newest unaffected release: 4.6.6 (Nov 6, 2026), the latest release
Advisories: 19 · 1 critical, 10 high, 7 medium, 1 low

Weekly downloads: 8.4M
Dependents: 3,926
Releases: 500+ since 0.28.13 (Nov 6, 2017)
Registry: PyPI
Releases read: Nov 8, 2026

Version timeline

CVE-2026-102832
Affects 4.5.7 to 4.5.10 (4.5.11 is outside it); 4.6.0 to 4.6.3 (4.6.4 is outside it)
CVE-2026-102904
Affects 4.0.0 to 4.5.10 (4.5.11 is outside it); 4.6.0 to 4.6.3 (4.6.4 is outside it)
CVE-2026-102831
Affects 4.5.0 to 4.5.10 (4.5.11 is outside it); 4.6.0 to 4.6.3 (4.6.4 is outside it)
CVE-2026-102830
Affects 3.0.0 to 4.5.10 (4.5.11 is outside it); 4.6.0 to 4.6.3 (4.6.4 is outside it)
CVE-2026-73417
Affects 3.3.0 to 4.5.9 (4.5.10 is outside it); 4.6.0 to 4.6.1 (4.6.2 is outside it)
CVE-2026-73416
Affects 4.5.0 to 4.5.9 (4.5.10 is outside it); 4.6.0 to 4.6.1 (4.6.2 is outside it)
CVE-2026-73627
Affects 4.1.0 to 4.5.9 (4.5.10 is outside it); 4.6.0 to 4.6.1 (4.6.2 is outside it)
CVE-2026-73626
Affects 0.28.13 to 4.5.9 (4.5.10 is outside it); 4.6.0 to 4.6.1 (4.6.2 is outside it)
CVE-2026-73415
Affects 0.28.13 to 4.5.9 (4.5.10 is outside it); 4.6.0 to 4.6.1 (4.6.2 is outside it)
CVE-2026-67338
Affects 0.28.13 to 4.5.8 (4.5.9 is outside it)
CVE-2026-42266
Affects 4.0.0 to 4.5.6 (4.5.7 is outside it)
CVE-2026-42557
Affects 0.28.13 to 4.5.6 (4.5.7 is outside it)

Show all 19 advisoriesShow fewer advisories

CVE-2026-40171
Affects 0.28.13 to 4.5.6 (4.5.7 is outside it)
CVE-2025-59842
Affects 0.28.13 to 4.4.7 (4.4.8 is outside it)
CVE-2024-43805
Affects 0.28.13 to 3.6.7 (3.6.8 is outside it); 4.0.0 to 4.2.4 (4.2.5 is outside it)
CVE-2024-39700
Affects 0.28.13 to 4.3.0rc1 (4.3.0 is outside it)
CVE-2024-22420
Affects 4.0.0 to 4.0.10 (4.0.11 is outside it)
CVE-2024-22421
Affects 0.28.13 to 3.6.6 (3.6.7 is outside it); 4.0.0 to 4.0.10 (4.0.11 is outside it)
CVE-2021-32797
Affects 0.28.13 to 1.2.20 (1.2.21 is outside it); 2.0.0a0 to 2.2.9 (2.2.10 is outside it); 2.3.0a0 to 2.3.1 (2.3.2 is outside it); 3.0.0a0 to 3.0.16 (3.0.17 is outside it); 3.1.0a0 to 3.1.2 (3.1.4 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 19

CVE-2026-102832Medium 4.2
JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked
Affected: from 4.6.0, fixed in 4.6.4; from 4.5.7, fixed in 4.5.11.
Fixed in 4.5.11 (released Sep 21, 2026, 22 days before disclosure) and 4.6.4 (released Sep 21, 2026, 22 days before disclosure).
The latest release, 4.6.6, is not affected.
CVE-2026-102904Medium 5.4
JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs
Affected: from 4.6.0, fixed in 4.6.4; from 4.0.0, fixed in 4.5.11; from 4.0.0, fixed in 4.5.11; from 4.6.0, fixed in 4.6.4.
Fixed in 4.5.11 (released Sep 21, 2026, 8 days before disclosure) and 4.6.4 (released Sep 21, 2026, 8 days before disclosure).
The latest release, 4.6.6, is not affected.
CVE-2026-102831High 8.1
JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard
Affected: from 4.6.0, fixed in 4.6.4; from 4.5.0, fixed in 4.5.11; from 4.5.0, fixed in 4.5.11; from 4.6.0, fixed in 4.6.4.
Fixed in 4.5.11 (released Sep 21, 2026, 8 days before disclosure) and 4.6.4 (released Sep 21, 2026, 8 days before disclosure).
The latest release, 4.6.6, is not affected.
CVE-2026-102830Medium 6.8
JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)
Affected: from 4.6.0, fixed in 4.6.4; from 3.0.0, fixed in 4.5.11; from 3.0.0, fixed in 4.5.11; from 4.6.0, fixed in 4.6.4.
Fixed in 4.5.11 (released Sep 21, 2026, 8 days before disclosure) and 4.6.4 (released Sep 21, 2026, 8 days before disclosure).
The latest release, 4.6.6, is not affected.
CVE-2026-73417High 8.6
JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)
Affected: from 3.3.0, fixed in 4.5.10; from 4.6.0, fixed in 4.6.2; from 4.6.0, fixed in 4.6.2; from 3.3.0, fixed in 4.5.10.
Fixed in 4.5.10 (released Jul 21, 2026, 23 days before disclosure) and 4.6.2 (released Jul 21, 2026, 23 days before disclosure).
The latest release, 4.6.6, is not affected.
CVE-2026-73416Medium 6.1
jupyterlab: PyPI extension blocklist package-name canonicalization bypass
Affected: from 4.6.0, fixed in 4.6.2; from 4.5.0, fixed in 4.5.10; from 4.5.0, fixed in 4.5.10; from 4.6.0, fixed in 4.6.2.
Fixed in 4.5.10 (released Jul 21, 2026, 23 days before disclosure) and 4.6.2 (released Jul 21, 2026, 23 days before disclosure).
The latest release, 4.6.6, is not affected.
CVE-2026-73627Medium 6.0
JupyterLab 4.6.0 Plugin Manager Lock-Rule Enforcement Bypass
Affected: from 4.6.0, fixed in 4.6.2; from 4.1.0, fixed in 4.5.10.
Fixed in 4.5.10 (released Jul 21, 2026, 23 days before disclosure) and 4.6.2 (released Jul 21, 2026, 23 days before disclosure).
The latest release, 4.6.6, is not affected.
CVE-2026-73626High 7.7
JupyterLab before 4.6.2 Authentication Bypass via PyPIExtensionManager
Affected: from 4.6.0, fixed in 4.6.2; fixed in 4.5.10.
Fixed in 4.5.10 (released Jul 21, 2026, 23 days before disclosure) and 4.6.2 (released Jul 21, 2026, 23 days before disclosure).
The latest release, 4.6.6, is not affected.
CVE-2026-73415High 7.5
jupyterlab: Image viewer in JupyterLab allows XSS when opening malicious image in new browser tab
Affected: from 4.6.0, fixed in 4.6.2; fixed in 4.5.10; fixed in 4.5.10; from 4.6.0, fixed in 4.6.2.
Fixed in 4.5.10 (released Jul 21, 2026, 22 days before disclosure) and 4.6.2 (released Jul 21, 2026, 22 days before disclosure).
The latest release, 4.6.6, is not affected.
CVE-2026-67338Medium 5.1
JupyterLab before 4.5.9 Stored XSS via Extension Manager
Affected: fixed in 4.5.9.
Fixed in 4.5.9 (released Jun 17, 2026, 45 days before disclosure).
The latest release, 4.6.6, is not affected.
CVE-2026-42266High 8.8
JupyterLab has an Extension Manager API/GUI Policy Discrepancy allowing 3rd party (malicious) extensions install via POST request.
Affected: from 4.0.0, fixed in 4.5.7.
Fixed in 4.5.7 (released Apr 29, 2026, 14 days before disclosure).
The latest release, 4.6.6, is not affected.
CVE-2026-42557High 8.6
jupyterlab: Command linker attributes in HTML enable one-click command execution from untrusted content
Affected: fixed in 4.5.7.
Fixed in 4.5.7 (released Apr 29, 2026, 14 days before disclosure).
The latest release, 4.6.6, is not affected.
CVE-2026-40171High 8.4
Jupyter Notebook and JupyterLab token theft via stored XSS in help command linker
Affected: fixed in 4.5.7.
Fixed in 4.5.7 (released Apr 29, 2026, 7 days before disclosure).
The latest release, 4.6.6, is not affected.
CVE-2025-59842Low 2.1
JupyterLab LaTeX typesetter links did not enforce `noopener` attribute
Affected: fixed in 4.4.8.
Fixed in 4.4.8 (released Sep 25, 2025, 1 day before disclosure).
The latest release, 4.6.6, is not affected.
CVE-2024-43805High 7.6
HTML injection in Jupyter Notebook and JupyterLab leading to DOM Clobbering
Affected: fixed in 3.6.8; from 4.0.0, fixed in 4.2.5; fixed in 3.6.8; from 4.0.0, fixed in 4.2.5.
Fixed in 3.6.8 (released Aug 26, 2024, 2 days before disclosure) and 4.2.5 (released Aug 26, 2024, 2 days before disclosure).
The latest release, 4.6.6, is not affected.

Show all 19 advisoriesShow fewer advisories

CVE-2024-39700Critical 10.0
Remote Code Execution (RCE) vulnerability in jupyterlab extension template `update-integration-tests` GitHub Action
Affected: fixed in 4.3.0.
Fixed in 4.3.0 (released Oct 30, 2024, 106 days after disclosure).
The latest release, 4.6.6, is not affected.
CVE-2024-22420Medium 6.5
Stored cross site scripting in Markdown Preview in JupyterLab
Affected: from 4.0.0, fixed in 4.0.11.
Fixed in 4.0.11 (released Jan 19, 2024, the day of disclosure).
The latest release, 4.6.6, is not affected.
CVE-2024-22421High 7.6
Potential authentication and CSRF tokens leak in JupyterLab
Affected: from 4.0.0, fixed in 4.0.11; fixed in 3.6.7; fixed in 3.6.7; from 4.0.0, fixed in 4.0.11.
Fixed in 3.6.7 (released Jan 19, 2024, the day of disclosure) and 4.0.11 (released Jan 19, 2024, the day of disclosure).
The latest release, 4.6.6, is not affected.
CVE-2021-32797High 7.4
JupyterLab: XSS due to lack of sanitization of the action attribute of an html <form>
Affected: fixed in 1.2.21; from 2, fixed in 2.2.10; from 2.3, fixed in 2.3.2; from 3, fixed in 3.0.17; from 3.1, fixed in 3.1.4; fixed in 1.2.21; from 2.0.0a0, fixed in 2.2.10; from 2.3.0a0, fixed in 2.3.2; from 3.0.0a0, fixed in 3.0.17; from 3.1.0a0, fixed in 3.1.4.
Fixed in 1.2.21 (released Aug 5, 2021, 4 days before disclosure), 2.2.10 (released Aug 5, 2021, 4 days before disclosure), 2.3.2 (released Aug 5, 2021, 4 days before disclosure) and 2 other versions.
The latest release, 4.6.6, is not affected.