The vulnerability (CVE-2026-67338) in JupyterLab prior to version 4.5.9 is a stored cross-site scripting issue located in the Extension Manager component. It fails to properly validate URI protocols in package metadata URLs, specifically allowing javascript: scheme URLs. Attackers can exploit this by publishing malicious PyPI packages containing such URLs in their project metadata. When a user interacts with the extension name in JupyterLab, the embedded JavaScript executes in the context of the JupyterLab origin, potentially leading to client-side code execution. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, with low confidentiality and integrity impact, and no availability impact.

Successful exploitation allows execution of arbitrary JavaScript code in the context of the JupyterLab origin when users click on a malicious extension name. This can lead to partial confidentiality and integrity compromise within the user's session or environment. There is no direct impact on availability. The vulnerability requires user interaction (clicking the extension name) and can be triggered remotely without privileges.

A fix is available in JupyterLab version 4.5.9. Users and administrators should upgrade to version 4.5.9 or later to remediate this vulnerability. Since this is not a cloud service, manual patching is required. No vendor advisory content was provided to indicate alternative mitigations or that no action is required.