Vendor

    Jupyterlab

    22 known vulnerabilities in products by Jupyterlab, 0 of them actively exploited (CISA KEV).

    Key figures

    22

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    4

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Jupyterlab
    HighCVE-2026-42266

    Jupyterlab: Argument Injection

    also in 1 other product

    		8.8
    CriticalCVE-2021-32797

    JupyterLab: XSS due to lack of sanitization of the action attribute of an html <form>

    also in 1 other product

    		7.4
    HighCVE-2026-73417

    JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)

    		—
    CriticalCVE-2024-39700

    Jupyterlab Extension-template: Code Injection

    also in 1 other product

    		10.0
    HighCVE-2026-73415

    jupyterlab: Image viewer in JupyterLab allows XSS when opening malicious image in new browser tab

    		—
    CriticalCVE-2026-54527

    JupyterLab Git: Stored XSS leading to RCE

    also in 1 other product

    		9.0
    MediumCVE-2026-73416

    jupyterlab: PyPI extension blocklist package-name canonicalization bypass

    		—
    CriticalCVE-2026-42557

    Jupyterlab: Cross-site Scripting

    also in 2 other products

    		9.6
    HighCVE-2026-40171

    Jupyter Notebook and JupyterLab token theft via stored XSS in help command linker

    also in 1 other product

    		—
    HighCVE-2026-102831

    Jupyterlab: Cross-site Scripting

    		8.1
    HighCVE-2026-73626

    JupyterLab before 4.6.2 Authentication Bypass via PyPIExtensionManager

    		7.5
    MediumCVE-2026-102830

    JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)

    		6.8
    HighCVE-2026-54528

    jupyterlab-git excluded_paths Case-Sensitivity Bypass Allows Reading Excluded Directories

    also in 1 other product

    		7.1
    HighCVE-2025-30370

    jupyterlab-git has a command injection vulnerability in "Open Git Repository in Terminal"

    		7.4
    HighCVE-2024-22421

    Potential authentication and CSRF tokens leak in JupyterLab

    also in 3 other products

    		7.6
    MediumCVE-2026-73627

    JupyterLab 4.6.0 Plugin Manager Lock-Rule Enforcement Bypass

    		—
    MediumCVE-2026-102904

    Jupyterlab: Argument Injection

    		5.4
    MediumCVE-2026-67338

    JupyterLab before 4.5.9 Stored XSS via Extension Manager

    		6.1
    MediumCVE-2024-22420

    Stored cross site scripting in Markdown Preview in JupyterLab

    also in 3 other products

    		6.5
    HighCVE-2024-43805

    HTML injection in Jupyter Notebook and JupyterLab leading to DOM Clobbering

    also in 2 other products

    		7.6
    MediumCVE-2026-102832

    JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked

    		4.2
    MediumCVE-2025-59842

    JupyterLab LaTeX typesetter links did not enforce `noopener` attribute

    also in 1 other product

    		4.3

    Products

    Products by Jupyterlab
    Jupyterlab180
    Jupyterlab-git30
    Jupyterlite-core30