JupyterLab: stored XSS from javascript: URLs in extension metadata shown by Extension Manager

CVSS 5.1CVE-2026-67338AI/ML frameworks & servingcurated

Impact

The Extension Manager renders URLs taken from package metadata without validating the URI protocol, so a package published with a javascript: URL in its project metadata executes script in the JupyterLab origin the moment a user clicks the extension name. Script running in that origin inherits the user's notebook session, which is the same session that can start kernels - so on a GPU node this turns 'a user browsed the extension list' into execution as that user, inside their pod, with their mounted data. The attacker never touches the cluster; they only need a package in whatever index the deployment's Extension Manager searches, which by default is PyPI. Victim interaction is required.

Who can reach it

An unauthenticated attacker publishes a package to the index the Extension Manager queries. Exploitation needs a logged-in JupyterLab user to open Extension Manager and click the crafted entry.

What to do

Upgrade jupyterlab to 4.5.9 or later and restart each notebook server; rebuild the singleuser image where notebooks are containerized. As an interim measure the Extension Manager can be disabled in the JupyterLab configuration, or pointed at a curated internal index, which removes the path without touching running workloads.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-67338 https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-vmhf-c436-hxj4 https://www.vulncheck.com/advisories/jupyterlab-before-stored-xss-via-extension-manager https://github.com/jupyterlab/jupyterlab/commit/4e61e07d0a91145b53fbf96ac74b0387f6bc51f6

Related entries

All AI/ML frameworks & serving entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.