Vulnerability · Published Aug 1, 2026 · Assigned by VulnCheck

CVE-2026-67338JupyterLab before 4.5.9 Stored XSS via Extension Manager

Medium 6.1

In plain English

A medium-severity security flaw in jupyterlab from jupyterlab. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.3%top 76.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the JupyterLab origin when users click the extension name.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:13	jupyterlab	no fix listed	DEBIAN-CVE-2026-67338
Debian:14	jupyterlab	4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-4	DEBIAN-CVE-2026-67338
PyPI	jupyterlab	4.5.9	GHSA-vmhf-c436-hxj4
Ubuntu:26.04:LTS	jupyterlab	no fix listed	UBUNTU-CVE-2026-67338
Ubuntu:26.10	jupyterlab	no fix listed	UBUNTU-CVE-2026-67338

Affected products (as reported)

Vendor	Product	Versions
jupyterlab	jupyterlab	0 – before 4.5.9

Weakness: CWE-84 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

GitHub Security Advisory (GHSA-vmhf-c436-hxj4) vendor-advisory
Patch Commit patch
Patch Commit patch
VulnCheck Advisory: JupyterLab before 4.5.9 Stored XSS via Extension Manager third-party-advisory