# cve.now: Jupyterlab

The newest entries naming Jupyterlab as an affected vendor (up to 200), of 26 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-102530](https://cve.now/CVE-2026-102530.md): JupyterLab Desktop: Cross-Site Scripting (XSS) leading to Remote Code Execution on Connect URL (CVSS 9.4)
- [CVE-2025-55002](https://cve.now/CVE-2025-55002.md): JupyterLab Desktop: TCC Bypass via Misconfigured Node Fuses (CVSS 5.5)
- [CVE-2026-86044](https://cve.now/CVE-2026-86044.md): JupyterLab Desktop: One-Click Jupyter Server Token Leak leading to Remote Code Execution (CVSS 9.6)
- [CVE-2025-54991](https://cve.now/CVE-2025-54991.md): JupyterLab Desktop: TCC Bypass via Insecure Entitlements (macOS) (CVSS 5.5)
- [CVE-2026-102832](https://cve.now/CVE-2026-102832.md): JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked (CVSS 4.2)
- [CVE-2026-102904](https://cve.now/CVE-2026-102904.md): JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs (CVSS 5.4)
- [CVE-2026-102831](https://cve.now/CVE-2026-102831.md): JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard (CVSS 8.1)
- [CVE-2026-102830](https://cve.now/CVE-2026-102830.md): JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json) (CVSS 6.8)
- [CVE-2026-73417](https://cve.now/CVE-2026-73417.md): JupyterLab: Cross-site scripting (XSS) via crafted settings file (\`overrides.json\`) (CVSS 8.6)
- [CVE-2026-73416](https://cve.now/CVE-2026-73416.md): jupyterlab: PyPI extension blocklist package-name canonicalization bypass (CVSS 6.1)
- [CVE-2026-73627](https://cve.now/CVE-2026-73627.md): JupyterLab 4.6.0 Plugin Manager Lock-Rule Enforcement Bypass (CVSS 6.0)
- [CVE-2026-73626](https://cve.now/CVE-2026-73626.md): JupyterLab before 4.6.2 Authentication Bypass via PyPIExtensionManager (CVSS 7.7)
- [CVE-2026-73415](https://cve.now/CVE-2026-73415.md): jupyterlab: Image viewer in JupyterLab allows XSS when opening malicious image in new browser tab (CVSS 7.5)
- [CVE-2026-67338](https://cve.now/CVE-2026-67338.md): JupyterLab before 4.5.9 Stored XSS via Extension Manager (CVSS 5.1)
- [CVE-2026-54528](https://cve.now/CVE-2026-54528.md): jupyterlab-git excluded\_paths Case-Sensitivity Bypass Allows Reading Excluded Directories (CVSS 7.1)
- [CVE-2026-54527](https://cve.now/CVE-2026-54527.md): JupyterLab Git: Stored XSS leading to RCE (CVSS 9.3)
- [CVE-2026-42266](https://cve.now/CVE-2026-42266.md): JupyterLab has an Extension Manager API/GUI Policy Discrepancy allowing 3rd party (malicious) extensions install via POST request. (CVSS 8.8)
- [CVE-2026-42557](https://cve.now/CVE-2026-42557.md): jupyterlab: Command linker attributes in HTML enable one-click command execution from untrusted content (CVSS 8.6)
- [CVE-2026-40171](https://cve.now/CVE-2026-40171.md): Jupyter Notebook and JupyterLab token theft via stored XSS in help command linker (CVSS 8.4)
- [CVE-2025-59842](https://cve.now/CVE-2025-59842.md): JupyterLab LaTeX typesetter links did not enforce \`noopener\` attribute (CVSS 2.1)
- [CVE-2025-30370](https://cve.now/CVE-2025-30370.md): jupyterlab-git has a command injection vulnerability in "Open Git Repository in Terminal" (CVSS 7.4)
- [CVE-2024-43805](https://cve.now/CVE-2024-43805.md): HTML injection in Jupyter Notebook and JupyterLab leading to DOM Clobbering (CVSS 7.6)
- [CVE-2024-39700](https://cve.now/CVE-2024-39700.md): Remote Code Execution (RCE) vulnerability in jupyterlab extension template \`update-integration-tests\` GitHub Action (CVSS 10.0)
- [CVE-2024-22420](https://cve.now/CVE-2024-22420.md): Stored cross site scripting in Markdown Preview in JupyterLab (CVSS 6.5)
- [CVE-2024-22421](https://cve.now/CVE-2024-22421.md): Potential authentication and CSRF tokens leak in JupyterLab (CVSS 7.6)
- [CVE-2021-32797](https://cve.now/CVE-2021-32797.md): JupyterLab: XSS due to lack of sanitization of the action attribute of an html \<form\> (CVSS 7.4)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/jupyterlab
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.