CVE-2026-67338: JupyterLab Stored XSS Vulnerability in Extension Manager
Summary
CVE-2026-67338: JupyterLab before 4.5.9 Stored XSS via Extension Manager. Affects jupyterlab versions < 4.5.9. Fixed in 4.5.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
JupyterLab is an open-source web-based interactive development environment for Jupyter notebooks, code, and data. It allows users to create and share documents that contain live code, equations, visualizations, and narrative text. The Extension Manager in JupyterLab enables users to install and manage extensions that enhance its functionality. However, prior to version 4.5.9, JupyterLab is vulnerable to a stored cross-site scripting (XSS) attack due to inadequate validation of URI protocols in package metadata URLs.
Vulnerability Detail
The vulnerability arises from the Extension Manager's failure to properly validate URI protocols in the metadata URLs of packages. This allows attackers to publish malicious PyPI packages that include 'javascript:' URLs in their metadata. When a user clicks on the extension name, the malicious JavaScript executes within the JupyterLab environment, potentially leading to unauthorized actions, data theft, or other malicious activities.
How To Fix
Minimum fixed version
4.5.9
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should avoid installing extensions from untrusted sources until they have updated to the patched version. Additionally, users can manually inspect package metadata for suspicious URLs before installation.
Conclusion
In summary, CVE-2026-67338 is a stored XSS vulnerability in JupyterLab's Extension Manager that can lead to serious security risks. Users are strongly advised to update to version 4.5.9 or later to mitigate this risk. Until then, caution should be exercised when installing extensions.
See every vulnerability recorded for jupyterlab →
FAQ
The impact includes potential execution of arbitrary JavaScript code in the JupyterLab environment, leading to data theft or unauthorized actions.
You can check your version of JupyterLab by running 'jupyter lab --version' in your terminal. If it is below 4.5.9, it is vulnerable.
If immediate updating is not possible, refrain from installing extensions from untrusted sources and inspect package metadata carefully.
More information can be found in the official vulnerability database or on GitHub under the JupyterLab repository.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for jupyterlab.
