jupyterlab

4 results · Clear filters · Feed

• Critical 9.4
  CVE-2026-102530

  JupyterLab Desktop: Cross-Site Scripting (XSS) leading to Remote Code Execution on Connect URL

  JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, remote-server URLs were inserted into the server-selection dialog and Welcome view without safe encoding. An attacker who convinces a user to submit a crafted URL c…

  jupyterlab jupyterlab-desktop
  Nov 6, 2026
• Critical 9.6
  CVE-2026-86044

  JupyterLab Desktop: One-Click Jupyter Server Token Leak leading to Remote Code Execution

  JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, JupyterLab Desktop exposed getServerInfo to the renderer without confirming that the current page still had the local Jupyter server origin. In a local managed sess…

  jupyterlab jupyterlab-desktop
  Nov 6, 2026
• Critical 9.3
  CVE-2026-54527

  JupyterLab Git: Stored XSS leading to RCE

  JupyterLab Git is a Git extension for JupyterLab. From 0.30.0b3 before 0.54.0, the PlainTextDiff.ts createHeader() method passes Git filenames directly to innerHTML when rendering renamed files in commit history, allowing a crafted filename to execute JavaScr…

  jupyterlab jupyterlab-git jupyterlab-git @jupyterlab/git npm PyPI
  Jul 8, 2026
• Critical 10.0
  CVE-2024-39700 Public exploit

  Remote Code Execution (RCE) vulnerability in jupyterlab extension template `update-integration-tests` GitHub Action

  JupyterLab extension template is a `copier` template for JupyterLab extensions. Repositories created using this template with `test` option include `update-integration-tests.yml` workflow which has an RCE vulnerability. Extension authors hosting their code on…

  jupyterlab extension-template jupyterlab PyPI
  Jul 16, 2024