Log in Start free

jupyterlab

Products

ProductCVEsExploitedLatest
jupyterlab18–Oct 13, 2026
jupyterlab-git3–Jul 8, 2026
jupyterlite-core3–Oct 13, 2026
notebook2–Oct 13, 2026
extension-template1–Jul 16, 2024
help-extension1–May 6, 2026

Exploited and recent CVEs

  • CVE-2026-102832 Medium 4.2 JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked 0.1%
  • CVE-2026-102832 Medium 4.2 JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked 0.1%
  • CVE-2026-102832 Medium 4.2 JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked 0.1%
  • CVE-2026-102904 Medium 5.4 JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs 0.2%
  • CVE-2026-102831 High 8.1 JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard 0.2%
  • CVE-2026-102831 High 8.1 JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard 0.2%
  • CVE-2026-102831 High 8.1 JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard 0.2%
  • CVE-2026-102830 Medium 6.8 JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json) 0.3%
  • CVE-2026-102830 Medium 6.8 JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json) 0.3%
  • CVE-2026-73417 High 8.6 JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`) 0.7%
  • CVE-2026-73416 Medium 6.1 jupyterlab: PyPI extension blocklist package-name canonicalization bypass 0.7%
  • CVE-2026-73627 Medium 6.0 JupyterLab 4.6.0 Plugin Manager Lock-Rule Enforcement Bypass 0.4%
  • CVE-2026-73626 High 7.5 JupyterLab before 4.6.2 Authentication Bypass via PyPIExtensionManager 0.4%
  • CVE-2026-73415 High 7.5 jupyterlab: Image viewer in JupyterLab allows XSS when opening malicious image in new browser tab 0.7%
  • CVE-2026-67338 Medium 6.1 JupyterLab before 4.5.9 Stored XSS via Extension Manager 0.3%
  • CVE-2026-54528 High 7.1 jupyterlab-git excluded_paths Case-Sensitivity Bypass Allows Reading Excluded Directories 0.4%
  • CVE-2026-54527 Critical 9.3 JupyterLab Git: Stored XSS leading to RCE 0.5%
  • CVE-2026-42266 High 8.8 JupyterLab has an Extension Manager API/GUI Policy Discrepancy allowing 3rd party (malicious) extensions install via POST request. 5.7%
  • CVE-2026-42557 High 8.8 jupyterlab: Command linker attributes in HTML enable one-click command execution from untrusted content 0.5%
  • CVE-2026-40171 High 8.4 Jupyter Notebook and JupyterLab token theft via stored XSS in help command linker 0.5%
  • CVE-2026-40171 High 8.4 Jupyter Notebook and JupyterLab token theft via stored XSS in help command linker 0.5%
  • CVE-2025-59842 Low 2.1 JupyterLab LaTeX typesetter links did not enforce `noopener` attribute 0.2%
  • CVE-2025-30370 High 7.4 jupyterlab-git has a command injection vulnerability in "Open Git Repository in Terminal" 0.6%
  • CVE-2024-43805 High 7.6 HTML injection in Jupyter Notebook and JupyterLab leading to DOM Clobbering 0.4%
  • CVE-2024-39700 Critical 10.0 Remote Code Execution (RCE) vulnerability in jupyterlab extension template `update-integration-tests` GitHub Action 1.1%
  • CVE-2024-22420 Medium 6.5 Stored cross site scripting in Markdown Preview in JupyterLab 0.6%
  • CVE-2024-22421 High 7.6 Potential authentication and CSRF tokens leak in JupyterLab 0.7%
  • CVE-2021-32797 High 7.4 JupyterLab: XSS due to lack of sanitization of the action attribute of an html <form> 2.7%