{"id":"OESA-2026-4168","summary":"python-jupyterlab security update","details":"JupyterLab is the next-generation user interface for Project Jupyter offering all the familiar building blocks of the classic Jupyter Notebook (notebook, terminal, text editor, file browser, rich outputs, etc.) in a flexible and powerful user interface.\r\n\r\nSecurity Fix(es):\n\nJupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the JupyterLab origin when users click the extension name.(CVE-2026-67338)\n\nJupyterLab versions >=4.6.0,<=4.6.1 and <=4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install(). A missing 'await' caused the is_install_allowed coroutine to never execute, so the extension allowlist/blocklist check was not enforced for direct callers of install(). The stock JupyterLab HTTP API and Extension Manager UI are not affected, as they perform a separate, correctly awaited check. The issue affects only deployments where a custom extension or downstream integration imports PyPIExtensionManager and calls install() directly with a package name influenced by untrusted input, an allowlist/blocklist is configured, the PyPI Extension Manager is enabled, and kernels and terminals are disabled or delegated to remote hosts. Fixed in JupyterLab 4.6.2 and 4.5.10.(CVE-2026-73626)","modified":"2026-10-01T02:00:04.278032803Z","published":"2026-09-30T13:47:15Z","upstream":["CVE-2026-67338","CVE-2026-73626"],"database_specific":{"severity":"High"},"references":[{"type":"ADVISORY","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4168"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67338"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73626"}],"affected":[{"package":{"name":"python-jupyterlab","ecosystem":"openEuler:24.03-LTS-SP4","purl":"pkg:rpm/openEuler/python-jupyterlab&distro=openEuler-24.03-LTS-SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.5-5.oe2403sp4"}]}],"ecosystem_specific":{"noarch":["python3-jupyterlab-4.3.5-5.oe2403sp4.noarch.rpm"],"src":["python-jupyterlab-4.3.5-5.oe2403sp4.src.rpm"]},"database_specific":{"source":"https://repo.openeuler.org/security/data/osv/OESA-2026-4168.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}