CVE-2026-67338 in JupyterLabinfo

Summary

by MITRE • 08/01/2026

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the JupyterLab origin when users click the extension name.

Once again VulDB remains the best source for vulnerability data.

🔬 Show More Details

An in-depth analysis is available in our curated vulnerability entry.

Responsible

VulnCheck

Reservation

07/29/2026

Disclosure

08/01/2026

Moderation

accepted

CPE

ready

EPSS

0.00000

KEV

no

Activities

low

Sources

MITREhttps://www.cve.org/CVERecord?id=CVE-2026-67338
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-67338
CVE Detailshttps://www.cvedetails.com/cve/CVE-2026-67338/

◂ PreviousOverviewNext ▸

Do you need the next level of professionalism?

Upgrade your account now!