Jupyterlab vulnerabilities
26 CVEs and advisories name Jupyterlab as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-102530JupyterLab Desktop: Cross-Site Scripting (XSS) leading to Remote Code Execution on Connect URL
- CVE-2025-55002JupyterLab Desktop: TCC Bypass via Misconfigured Node Fuses
- CVE-2026-86044JupyterLab Desktop: One-Click Jupyter Server Token Leak leading to Remote Code Execution
- CVE-2025-54991JupyterLab Desktop: TCC Bypass via Insecure Entitlements (macOS)
- CVE-2026-102832JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked
- CVE-2026-102904JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs
- CVE-2026-102831JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard
- CVE-2026-102830JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)
- CVE-2026-73417JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)
- CVE-2026-73416jupyterlab: PyPI extension blocklist package-name canonicalization bypass
- CVE-2026-73627JupyterLab 4.6.0 Plugin Manager Lock-Rule Enforcement Bypass
- CVE-2026-73626JupyterLab before 4.6.2 Authentication Bypass via PyPIExtensionManager
- CVE-2026-73415jupyterlab: Image viewer in JupyterLab allows XSS when opening malicious image in new browser tab
- CVE-2026-67338JupyterLab before 4.5.9 Stored XSS via Extension Manager
- CVE-2026-54528jupyterlab-git excluded_paths Case-Sensitivity Bypass Allows Reading Excluded Directories
- CVE-2026-54527JupyterLab Git: Stored XSS leading to RCE
- CVE-2026-42266JupyterLab has an Extension Manager API/GUI Policy Discrepancy allowing 3rd party (malicious) extensions install via POST request.
- CVE-2026-42557jupyterlab: Command linker attributes in HTML enable one-click command execution from untrusted content
- CVE-2026-40171Jupyter Notebook and JupyterLab token theft via stored XSS in help command linker
- CVE-2025-59842JupyterLab LaTeX typesetter links did not enforce `noopener` attribute
- CVE-2025-30370jupyterlab-git has a command injection vulnerability in "Open Git Repository in Terminal"
- CVE-2024-43805HTML injection in Jupyter Notebook and JupyterLab leading to DOM Clobbering
- CVE-2024-39700Remote Code Execution (RCE) vulnerability in jupyterlab extension template `update-integration-tests` GitHub Action
- CVE-2024-22420Stored cross site scripting in Markdown Preview in JupyterLab
- CVE-2024-22421Potential authentication and CSRF tokens leak in JupyterLab
- CVE-2021-32797JupyterLab: XSS due to lack of sanitization of the action attribute of an html <form>