This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-67338 →

DEBIAN-CVE-2026-67338

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package...

Original description

The description as published by the source.

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the JupyterLab origin when users click the extension name.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:13 jupyterlab

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 jupyterlab

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-4"}]}]

References

advisory security-tracker.debian.org