CVE-2026-67338: JupyterLab before 4.5.9 Stored XSS via Extension Manager
Published Aug 1, 2026
·Updated
JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the JupyterLab origin when users click the extension name.
Affected Software
1 affected component
jupyter JupyterLab<4.5.9
Event History
Aug 1, 2026
CVE Published
via MITRE·12:22 PM
Data Sourced
via MITRE·12:22 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·01:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-67338?
CVE-2026-67338 has a medium severity rating of 5.1.
2
How do I fix CVE-2026-67338?
To fix CVE-2026-67338, upgrade JupyterLab to version 4.5.9 or later.
3
What type of vulnerability is CVE-2026-67338?
CVE-2026-67338 is a stored cross-site scripting (XSS) vulnerability.
4
What software is affected by CVE-2026-67338?
CVE-2026-67338 affects JupyterLab versions prior to 4.5.9.
5
How does CVE-2026-67338 exploit work?
CVE-2026-67338 exploits the failure to validate URI protocols in package metadata URLs, allowing attackers to execute arbitrary JavaScript.