Skip to content
OpenAdvisories

Package · Wolfi

py3.11-jupyterlab

38 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 8.1
    CVE-2026-4800 Public exploit

    lodash vulnerable to Code Injection via `_.template` imports key names

    The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink. When an application passes untrusted input as …

    lodash lodash lodash-amd lodash-es Debian Ubuntu Wolfi npm
  • Critical 9.8
    CVE-2026-33937 Public exploit

    Handlebars.js has JavaScript Injection via AST Type Confusion

    Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `Handlebars.compile()` accepts a pre-parsed AST object in addition to a template string. The `value` field of a `NumberLiteral` AST node is emitted…

    handlebars-lang handlebars.js prism opensearch-dashboards-3 Debian Ubuntu Wolfi npm
  • High 8.2
    CVE-2026-31802 Public exploit

    node-tar Symlink Path Traversal via Drive-Relative Linkpath

    node-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar (npm) can be tricked into creating a symlink that points outside the extraction directory by using a drive-relative symlink target such as C:../../../target.txt, which enables file over…

    isaacs node-tar katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Wolfi npm
  • High 8.2
    CVE-2026-29786 Public exploit

    node-tar: Hardlink Path Traversal via Drive-Relative Linkpath

    node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables file overwrite outside …

    isaacs node-tar katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Wolfi npm
  • Medium 6.9
    CVE-2025-13465 Public exploit

    Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions

    The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their ori…

    lodash lodash lodash-es lodash-amd Debian Ubuntu Wolfi npm
  • High 8.2
    CVE-2026-23745 Public exploit

    node-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization

    node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root r…

    isaacs node-tar katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Wolfi npm
  • High 8.1
    CVE-2024-29415 Public exploit

    ip SSRF improper categorization in isPublic

    The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of …

    jupyter-base-notebook sqlpad pnpm-stage0 py3.13-jupyterlab Debian Ubuntu Wolfi npm