JupyterLab versions 3.3.0 up to but not including 4.6.2 contain a cross-site scripting (XSS) vulnerability via crafted settings files named overrides.json. This file can be imported by users or automatically loaded from configuration directories. The vulnerability allows embedded code in the settings file to execute with the user's privileges, potentially reading or modifying notebooks and running code on the notebook server and connected kernels. The issue arises because certain notebook display settings were not properly validated before application. Patches are available in versions 4.6.2 and later.