JupyterLab versions 3.0.0 through 4.6.3 are vulnerable to a cross-site scripting (XSS) issue via crafted language pack pluralization headers. The vulnerability arises because JupyterLab improperly executes plural rule strings from language pack metadata using JavaScript's new Function, allowing injected code to run in the user's browser session. This affects users who have installed and selected a malicious or compromised language pack. The vulnerability enables execution of arbitrary JavaScript in the context of the authenticated user, potentially allowing access to Jupyter Server REST API and file system operations. Patches are available in JupyterLab 4.6.4 and 4.5.11. Users of JupyterLab 3.x should upgrade to supported 4.x versions. Workarounds include forcing the interface to use the English locale, which loads no language catalogues.