Database/AI/ML frameworks & serving
JupyterLab: stored XSS from javascript: URLs in extension metadata shown by Extension Manager
Impact
The Extension Manager renders URLs taken from package metadata without validating the URI protocol, so a package published with a javascript: URL in its project metadata executes script in the JupyterLab origin the moment a user clicks the extension name. Script running in that origin inherits the user's notebook session, which is the same session that can start kernels - so on a GPU node this turns 'a user browsed the extension list' into execution as that user, inside their pod, with their mounted data. The attacker never touches the cluster; they only need a package in whatever index the deployment's Extension Manager searches, which by default is PyPI. Victim interaction is required.
Who can reach it
An unauthenticated attacker publishes a package to the index the Extension Manager queries. Exploitation needs a logged-in JupyterLab user to open Extension Manager and click the crafted entry.
What to do
Upgrade jupyterlab to 4.5.9 or later and restart each notebook server; rebuild the singleuser image where notebooks are containerized. As an interim measure the Extension Manager can be disabled in the JupyterLab configuration, or pointed at a curated internal index, which removes the path without touching running workloads.
References
Related entries
- TensorFlow Lite (flatbuffer models): Out-of-bounds via duplicate tensor indices in flatbuffer modelsCVE-2020-15211 · TensorFlow Lite (flatbuffer models)Medium
- Hugging Face Text Embeddings Inference: API key written to logs in cleartext at router startupCVE-2026-108857 · Hugging Face Text Embeddings Inference (router startup log)Medium
- ExLlamaV2: out-of-bounds write in the CUDA GPTQ index handler via crafted g_idxCVE-2026-116502 · ExLlamaV2 CUDA extension (QMatrix::make_sequential GPTQ g_idx handling)Medium
- vLLM: OpenAI-compatible server ships a wildcard CORS origin, letting any web page drive it from a browserCVE-2026-115917 · vLLM OpenAI-compatible API server (Starlette CORSMiddleware default)Medium
- Intel Extension for PyTorch: unsafe deserialization of untrusted data allows local privilege escalationCVE-2026-35502 · Intel Extension for PyTorch (untrusted deserialization)Medium
- diffusers (shard file loader): Path traversal in `_get_checkpoint_shard_files`CVE-2026-65920 · diffusers (shard file loader)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.