jupyterlab vulnerabilities

CVEs per yearBy the year they were published

1. 20211
2. 20244
3. 20252
4. 202619

Newest CVEs

• CVE-2026-102530

  JupyterLab Desktop: Cross-Site Scripting (XSS) leading to Remote Code Execution on Connect URL

  jupyterlab · jupyterlab-desktop

  Critical9.4
• CVE-2025-55002

  JupyterLab Desktop: TCC Bypass via Misconfigured Node Fuses

  jupyterlab · jupyterlab-desktop

  Medium5.5
• CVE-2026-86044

  JupyterLab Desktop: One-Click Jupyter Server Token Leak leading to Remote Code Execution

  jupyterlab · jupyterlab-desktop

  Critical9.6
• CVE-2025-54991

  JupyterLab Desktop: TCC Bypass via Insecure Entitlements (macOS)

  jupyterlab · jupyterlab-desktop

  Medium5.5
• CVE-2026-102832

  JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked

  jupyterlab · jupyterlab

  Medium4.2
• CVE-2026-102904

  JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs

  jupyterlab · jupyterlab

  Medium5.4
• CVE-2026-102831

  JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard

  jupyterlab · jupyterlab

  High8.1
• CVE-2026-102830

  JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)

  jupyterlab · jupyterlab

  Medium6.8
• CVE-2026-73417

  JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)

  jupyterlab · jupyterlab

  High8.6
• CVE-2026-73416

  jupyterlab: PyPI extension blocklist package-name canonicalization bypass

  jupyterlab · jupyterlab

  Medium6.1