The JupyterLab extension template prior to version 4.3.1 includes a GitHub Actions workflow file 'update-integration-tests.yml' that contains a remote code execution (RCE) vulnerability. This affects repositories created with the template using the 'test' option from versions 1.2.0 up to but not including 4.3.1. Extension authors hosting code on GitHub should upgrade to version 4.3.1 or later to mitigate this critical vulnerability. Users who modified the workflow file should accept overwriting it during upgrade and reapply changes afterward. Temporarily disabling GitHub Actions during the upgrade is recommended, as is rebasing pull requests from untrusted users to avoid running vulnerable workflows.