Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2026-67338 →

DEBIAN-CVE-2026-67338

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the JupyterLab origin when users click the extension name.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Debian:13 jupyterlab

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 jupyterlab

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-4"}]}]

Références

advisory security-tracker.debian.org