Skip to content
Jupyterlab vulnerabilities
Newest
-
jupyterlab jupyterlab-desktop
JupyterLab Desktop: Cross-Site Scripting (XSS) leading to Remote Code Execution on Connect URL
CVE-2026-102530
9.4 Critical
-
jupyterlab jupyterlab-desktop
JupyterLab Desktop: TCC Bypass via Misconfigured Node Fuses
CVE-2025-55002
5.5 Medium
-
jupyterlab jupyterlab-desktop
JupyterLab Desktop: One-Click Jupyter Server Token Leak leading to Remote Code Execution
CVE-2026-86044
9.6 Critical
-
jupyterlab jupyterlab-desktop
JupyterLab Desktop: TCC Bypass via Insecure Entitlements (macOS)
CVE-2025-54991
5.5 Medium
-
jupyter notebook, jupyterlab, jupyterlab jupyterlite-core +2 more
JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked
CVE-2026-102832
Fix available
4.2 Medium
-
jupyterlab
JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs
CVE-2026-102904
Fix available
5.4 Medium
-
jupyter notebook, jupyterlab, jupyterlab jupyterlite-core +2 more
JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard
CVE-2026-102831
Fix available
8.1 High
-
jupyterlab, jupyterlab jupyterlite-core +1 more
JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)
CVE-2026-102830
Fix available
6.8 Medium
-
jupyterlab
JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)
CVE-2026-73417
Fix available
8.6 High
-
jupyterlab
jupyterlab: Image viewer in JupyterLab allows XSS when opening malicious image in new browser tab
CVE-2026-73415
Fix available
7.5 High
-
jupyterlab
jupyterlab: PyPI extension blocklist package-name canonicalization bypass
CVE-2026-73416
Fix available
6.1 Medium
-
jupyterlab
JupyterLab 4.6.0 Plugin Manager Lock-Rule Enforcement Bypass
CVE-2026-73627
Fix available
6.0 Medium
-
jupyterlab
JupyterLab before 4.6.2 Authentication Bypass via PyPIExtensionManager
CVE-2026-73626
Fix available
7.7 High
-
jupyter jupyterlab-git
jupyterlab-git excluded_paths Case-Sensitivity Bypass Allows Reading Excluded Directories
CVE-2026-54528
Fix available
7.1 High
-
jupyter jupyterlab-git
JupyterLab Git: Stored XSS leading to RCE
CVE-2026-54527
Fix available
9.3 Critical
-
jupyterlab
JupyterLab before 4.5.9 Stored XSS via Extension Manager
CVE-2026-67338
Fix available
5.1 Medium
-
jupyter jupyterlab, notebook, red hat migration toolkit for applications 8.2 +2 more +4 more
jupyterlab: Command linker attributes in HTML enable one-click command execution from untrusted content
CVE-2026-42557
Fix available
8.6 High
-
jupyter jupyterlab, red hat migration toolkit for applications 8.2, openshift ai (rhoai) +1 more +3 more
JupyterLab has an Extension Manager API/GUI Policy Discrepancy allowing 3rd party (malicious) extensions install via POST request.
CVE-2026-42266
Fix available
8.8 High
-
jupyter notebook, jupyter-notebook help-extension, jupyterlab +2 more
Jupyter Notebook and JupyterLab token theft via stored XSS in help command linker
CVE-2026-40171
Fix available
8.4 High
-
jupyter jupyterlab
JupyterLab LaTeX typesetter links did not enforce `noopener` attribute
CVE-2025-59842
Fix available
2.1 Low
-
jupyterlab jupyterlab-git
jupyterlab-git has a command injection vulnerability in "Open Git Repository in Terminal"
CVE-2025-30370
Fix available
7.4 High
-
jupyter jupyterlab, notebook +1 more
HTML injection in Jupyter Notebook and JupyterLab leading to DOM Clobbering
CVE-2024-43805
Fix available
7.6 High
-
jupyter jupyterlab, extension-template +1 more
Remote Code Execution (RCE) vulnerability in jupyterlab extension template `update-integration-tests` GitHub Action
CVE-2024-39700
Public exploitFix available
10.0 Critical
-
jupyter jupyterlab, notebook, fedoraproject fedora +2 more
Potential authentication and CSRF tokens leak in JupyterLab
CVE-2024-22421
Fix available
7.6 High
-
jupyter jupyterlab, notebook, fedoraproject fedora +2 more
Stored cross site scripting in Markdown Preview in JupyterLab
CVE-2024-22420
Fix available
6.5 Medium
-
jupyter jupyterlab
JupyterLab: XSS due to lack of sanitization of the action attribute of an html <form>
CVE-2021-32797
Fix available
7.4 High