Threats tagged 'brew-jupyterlab-cve-2026-67338'

JupyterLab versions from 1.2.0 up to but not including 4.5.9 contain a stored cross-site scripting (XSS) vulnerability in the Extension Manager. A malicious PyPI package can include a 'javascript:' URL in its metadata, which JupyterLab renders as a clickable homepage link without validating the URL protocol. When a user clicks this link, attacker-controlled JavaScript executes in the JupyterLab origin. This vulnerability requires the Extension Manager to be enabled with the default PyPI source and the malicious package to appear in the user's extension list.