Vulnerability-Lookup

OPENSUSE-SU-2026:11945-1

Vulnerability from csaf_opensuse - Published: 2026-10-01 00:00 - Updated: 2026-10-02 10:46

Summary

jupyter-jupyterlab-4.5.11-1.1 on GA media

Severity

Moderate

Notes

Title of the patch: jupyter-jupyterlab-4.5.11-1.1 on GA media

Description of the patch: These are all security issues fixed in the jupyter-jupyterlab-4.5.11-1.1 package on the GA media of openSUSE Tumbleweed.

Patchnames: openSUSE-Tumbleweed-2026-11945

CVE-2026-102830

Affected products

Recommended 12 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:jupyter-jupyterlab-0:4.5.11-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:jupyter-jupyterlab-0:4.5.11-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:jupyter-jupyterlab-0:4.5.11-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:jupyter-jupyterlab-0:4.5.11-1.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python313-jupyterlab-0:4.5.11-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python313-jupyterlab-0:4.5.11-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python313-jupyterlab-0:4.5.11-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python313-jupyterlab-0:4.5.11-1.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python314-jupyterlab-0:4.5.11-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python314-jupyterlab-0:4.5.11-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python314-jupyterlab-0:4.5.11-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:python314-jupyterlab-0:4.5.11-1.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2026-102831

Affected products

Recommended 12 products, the same list as for CVE-2026-102830

Threats

Impact important

CVE-2026-102904

Affected products

Recommended 12 products, the same list as for CVE-2026-102830

Threats

Impact moderate

References

11 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/o…	self
https://www.suse.com/security/cve/CVE-2026-102830/	self
https://www.suse.com/security/cve/CVE-2026-102831/	self
https://www.suse.com/security/cve/CVE-2026-102904/	self
https://www.suse.com/security/cve/CVE-2026-102830	external
https://bugzilla.suse.com/1283355	external
https://www.suse.com/security/cve/CVE-2026-102831	external
https://bugzilla.suse.com/1283354	external
https://www.suse.com/security/cve/CVE-2026-102904	external
https://bugzilla.suse.com/1283353	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "jupyter-jupyterlab-4.5.11-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the jupyter-jupyterlab-4.5.11-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-11945",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11945-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-102830 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-102830/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-102831 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-102831/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-102904 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-102904/"
      }
    ],
    "title": "jupyter-jupyterlab-4.5.11-1.1 on GA media",
    "tracking": {
      "current_release_date": "2026-10-02T10:46:47Z",
      "generator": {
        "date": "2026-10-01T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:11945-1",
      "initial_release_date": "2026-10-01T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-10-01T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-10-02T10:46:47Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jupyter-jupyterlab-0:4.5.11-1.1.aarch64",
                "product": {
                  "name": "jupyter-jupyterlab-0:4.5.11-1.1.aarch64",
                  "product_id": "jupyter-jupyterlab-0:4.5.11-1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/jupyter-jupyterlab@4.5.11-1.1?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python313-jupyterlab-0:4.5.11-1.1.aarch64",
                "product": {
                  "name": "python313-jupyterlab-0:4.5.11-1.1.aarch64",
                  "product_id": "python313-jupyterlab-0:4.5.11-1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python313-jupyterlab@4.5.11-1.1?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python314-jupyterlab-0:4.5.11-1.1.aarch64",
                "product": {
                  "name": "python314-jupyterlab-0:4.5.11-1.1.aarch64",
                  "product_id": "python314-jupyterlab-0:4.5.11-1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python314-jupyterlab@4.5.11-1.1?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jupyter-jupyterlab-0:4.5.11-1.1.ppc64le",
                "product": {
                  "name": "jupyter-jupyterlab-0:4.5.11-1.1.ppc64le",
                  "product_id": "jupyter-jupyterlab-0:4.5.11-1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/jupyter-jupyterlab@4.5.11-1.1?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python313-jupyterlab-0:4.5.11-1.1.ppc64le",
                "product": {
                  "name": "python313-jupyterlab-0:4.5.11-1.1.ppc64le",
                  "product_id": "python313-jupyterlab-0:4.5.11-1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python313-jupyterlab@4.5.11-1.1?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python314-jupyterlab-0:4.5.11-1.1.ppc64le",
                "product": {
                  "name": "python314-jupyterlab-0:4.5.11-1.1.ppc64le",
                  "product_id": "python314-jupyterlab-0:4.5.11-1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python314-jupyterlab@4.5.11-1.1?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jupyter-jupyterlab-0:4.5.11-1.1.s390x",
                "product": {
                  "name": "jupyter-jupyterlab-0:4.5.11-1.1.s390x",
                  "product_id": "jupyter-jupyterlab-0:4.5.11-1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/jupyter-jupyterlab@4.5.11-1.1?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python313-jupyterlab-0:4.5.11-1.1.s390x",
                "product": {
                  "name": "python313-jupyterlab-0:4.5.11-1.1.s390x",
                  "product_id": "python313-jupyterlab-0:4.5.11-1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python313-jupyterlab@4.5.11-1.1?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python314-jupyterlab-0:4.5.11-1.1.s390x",
                "product": {
                  "name": "python314-jupyterlab-0:4.5.11-1.1.s390x",
                  "product_id": "python314-jupyterlab-0:4.5.11-1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python314-jupyterlab@4.5.11-1.1?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jupyter-jupyterlab-0:4.5.11-1.1.x86_64",
                "product": {
                  "name": "jupyter-jupyterlab-0:4.5.11-1.1.x86_64",
                  "product_id": "jupyter-jupyterlab-0:4.5.11-1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/jupyter-jupyterlab@4.5.11-1.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python313-jupyterlab-0:4.5.11-1.1.x86_64",
                "product": {
                  "name": "python313-jupyterlab-0:4.5.11-1.1.x86_64",
                  "product_id": "python313-jupyterlab-0:4.5.11-1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python313-jupyterlab@4.5.11-1.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python314-jupyterlab-0:4.5.11-1.1.x86_64",
                "product": {
                  "name": "python314-jupyterlab-0:4.5.11-1.1.x86_64",
                  "product_id": "python314-jupyterlab-0:4.5.11-1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/python314-jupyterlab@4.5.11-1.1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jupyter-jupyterlab-0:4.5.11-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:jupyter-jupyterlab-0:4.5.11-1.1.aarch64"
        },
        "product_reference": "jupyter-jupyterlab-0:4.5.11-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jupyter-jupyterlab-0:4.5.11-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:jupyter-jupyterlab-0:4.5.11-1.1.ppc64le"
        },
        "product_reference": "jupyter-jupyterlab-0:4.5.11-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jupyter-jupyterlab-0:4.5.11-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:jupyter-jupyterlab-0:4.5.11-1.1.s390x"
        },
        "product_reference": "jupyter-jupyterlab-0:4.5.11-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jupyter-jupyterlab-0:4.5.11-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:jupyter-jupyterlab-0:4.5.11-1.1.x86_64"
        },
        "product_reference": "jupyter-jupyterlab-0:4.5.11-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-jupyterlab-0:4.5.11-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-jupyterlab-0:4.5.11-1.1.aarch64"
        },
        "product_reference": "python313-jupyterlab-0:4.5.11-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-jupyterlab-0:4.5.11-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-jupyterlab-0:4.5.11-1.1.ppc64le"
        },
        "product_reference": "python313-jupyterlab-0:4.5.11-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-jupyterlab-0:4.5.11-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-jupyterlab-0:4.5.11-1.1.s390x"
        },
        "product_reference": "python313-jupyterlab-0:4.5.11-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-jupyterlab-0:4.5.11-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-jupyterlab-0:4.5.11-1.1.x86_64"
        },
        "product_reference": "python313-jupyterlab-0:4.5.11-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-jupyterlab-0:4.5.11-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-jupyterlab-0:4.5.11-1.1.aarch64"
        },
        "product_reference": "python314-jupyterlab-0:4.5.11-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-jupyterlab-0:4.5.11-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-jupyterlab-0:4.5.11-1.1.ppc64le"
        },
        "product_reference": "python314-jupyterlab-0:4.5.11-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-jupyterlab-0:4.5.11-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-jupyterlab-0:4.5.11-1.1.s390x"
        },
        "product_reference": "python314-jupyterlab-0:4.5.11-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-jupyterlab-0:4.5.11-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-jupyterlab-0:4.5.11-1.1.x86_64"
        },
        "product_reference": "python314-jupyterlab-0:4.5.11-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-102830",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-102830"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 3.0.0 until 4.5.11 and 4.6.4, and in JupyterLite Core 0.8.3 and earlier, the Plural-Forms header in a selected third-party language pack can append JavaScript after a valid plural rule because prefix-only regular-expression validation accepts a matching prefix without requiring the entire header to match. JupyterLab passes the accepted expression to new Function, so loading the catalogue and translating a plural string executes the appended code in the authenticated JupyterLab origin. Where Jupyter Server kernels, terminals, and APIs are exposed, the code can use authenticated server APIs to read or modify files and run code. Impact is much more limited in JupyterLite because it typically lacks most exposed Jupyter Server surfaces. The default English locale is unaffected because it does not load a translation catalogue. This issue is fixed in JupyterLab 4.5.11 and 4.6.4 and JupyterLite Core 0.8.4.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:jupyter-jupyterlab-0:4.5.11-1.1.aarch64",
          "openSUSE Tumbleweed:jupyter-jupyterlab-0:4.5.11-1.1.ppc64le",
          "openSUSE Tumbleweed:jupyter-jupyterlab-0:4.5.11-1.1.s390x",
          "openSUSE Tumbleweed:jupyter-jupyterlab-0:4.5.11-1.1.x86_64",
          "openSUSE Tumbleweed:python313-jupyterlab-0:4.5.11-1.1.aarch64",
          "openSUSE Tumbleweed:python313-jupyterlab-0:4.5.11-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-jupyterlab-0:4.5.11-1.1.s390x",
          "openSUSE Tumbleweed:python313-jupyterlab-0:4.5.11-1.1.x86_64",
          "openSUSE Tumbleweed:python314-jupyterlab-0:4.5.11-1.1.aarch64",
          "openSUSE Tumbleweed:python314-jupyterlab-0:4.5.11-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-jupyterlab-0:4.5.11-1.1.s390x",
          "openSUSE Tumbleweed:python314-jupyterlab-0:4.5.11-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-102830",
          "url": "https://www.suse.com/security/cve/CVE-2026-102830"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1283355 for CVE-2026-102830",
          "url": "https://bugzilla.suse.com/1283355"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:jupyter-jupyterlab-0:4.5.11-1.1.aarch64",
            "openSUSE Tumbleweed:jupyter-jupyterlab-0:4.5.11-1.1.ppc64le",
            "openSUSE Tumbleweed:jupyter-jupyterlab-0:4.5.11-1.1.s390x",
            "openSUSE Tumbleweed:jupyter-jupyterlab-0:4.5.11-1.1.x86_64",
            "openSUSE Tumbleweed:python313-jupyterlab-0:4.5.11-1.1.aarch64",
            "openSUSE Tumbleweed:python313-jupyterlab-0:4.5.11-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-jupyterlab-0:4.5.11-1.1.s390x",
            "openSUSE Tumbleweed:python313-jupyterlab-0:4.5.11-1.1.x86_64",
            "openSUSE Tumbleweed:python314-jupyterlab-0:4.5.11-1.1.aarch64",
            "openSUSE Tumbleweed:python314-jupyterlab-0:4.5.11-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-jupyterlab-0:4.5.11-1.1.s390x",
            "openSUSE Tumbleweed:python314-jupyterlab-0:4.5.11-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-01T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-102830"
    },
    {
      "cve": "CVE-2026-102831",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-102831"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.5.0 until 4.5.11 and 4.6.4, from Notebook 7.5.0 until 7.6.3, and from JupyterLite Core 0.7.0 until 0.8.4, the system clipboard cell-paste path accepts attacker-controlled cell JSON without clearing metadata.trusted. When useSystemClipboardForCells is active and pasteCodeCellsWithoutOutput is disabled, a pasted code cell can mark HTML output as trusted, bypass output sanitization, and execute script in the authenticated JupyterLab origin without executing the cell. Markdown and raw cells are not affected because their output is sanitized. This issue is fixed in JupyterLab 4.5.11 and 4.6.4, Notebook 7.6.3, and JupyterLite Core 0.8.4.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:jupyter-jupyterlab-0:4.5.11-1.1.aarch64",
          "openSUSE Tumbleweed:jupyter-jupyterlab-0:4.5.11-1.1.ppc64le",
          "openSUSE Tumbleweed:jupyter-jupyterlab-0:4.5.11-1.1.s390x",
          "openSUSE Tumbleweed:jupyter-jupyterlab-0:4.5.11-1.1.x86_64",
          "openSUSE Tumbleweed:python313-jupyterlab-0:4.5.11-1.1.aarch64",
          "openSUSE Tumbleweed:python313-jupyterlab-0:4.5.11-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-jupyterlab-0:4.5.11-1.1.s390x",
          "openSUSE Tumbleweed:python313-jupyterlab-0:4.5.11-1.1.x86_64",
          "openSUSE Tumbleweed:python314-jupyterlab-0:4.5.11-1.1.aarch64",
          "openSUSE Tumbleweed:python314-jupyterlab-0:4.5.11-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-jupyterlab-0:4.5.11-1.1.s390x",
          "openSUSE Tumbleweed:python314-jupyterlab-0:4.5.11-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-102831",
          "url": "https://www.suse.com/security/cve/CVE-2026-102831"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1283354 for CVE-2026-102831",
          "url": "https://bugzilla.suse.com/1283354"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:jupyter-jupyterlab-0:4.5.11-1.1.aarch64",
            "openSUSE Tumbleweed:jupyter-jupyterlab-0:4.5.11-1.1.ppc64le",
            "openSUSE Tumbleweed:jupyter-jupyterlab-0:4.5.11-1.1.s390x",
            "openSUSE Tumbleweed:jupyter-jupyterlab-0:4.5.11-1.1.x86_64",
            "openSUSE Tumbleweed:python313-jupyterlab-0:4.5.11-1.1.aarch64",
            "openSUSE Tumbleweed:python313-jupyterlab-0:4.5.11-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-jupyterlab-0:4.5.11-1.1.s390x",
            "openSUSE Tumbleweed:python313-jupyterlab-0:4.5.11-1.1.x86_64",
            "openSUSE Tumbleweed:python314-jupyterlab-0:4.5.11-1.1.aarch64",
            "openSUSE Tumbleweed:python314-jupyterlab-0:4.5.11-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-jupyterlab-0:4.5.11-1.1.s390x",
            "openSUSE Tumbleweed:python314-jupyterlab-0:4.5.11-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-01T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-102831"
    },
    {
      "cve": "CVE-2026-102904",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-102904"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.0.0 until 4.5.11 and 4.6.4, the PyPI Extension Manager uninstall request reaches ExtensionHandler.post, which validates extension names for installation but passes uninstall names to PyPIExtensionManager.uninstall and python -m pip uninstall without rejecting option-like values. The security impact requires that the PyPI Extension Manager is enabled, the account can call the extension API, and kernels and terminals are disabled or delegated to remote hosts; otherwise the user can already read files and make outbound requests directly. An authenticated user with extension API access can supply a pip requirements option to make the server read a local file or fetch an internal URL, and reflected parse errors can return the first unparsable line or response content. A pip log option can also create or corrupt a chosen path with pip-generated log text, but the requester cannot select an arbitrary disclosed line or arbitrary file content, and the injection does not add code execution or availability impact beyond ordinary package removal. This issue is fixed in JupyterLab 4.5.11 and 4.6.4.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:jupyter-jupyterlab-0:4.5.11-1.1.aarch64",
          "openSUSE Tumbleweed:jupyter-jupyterlab-0:4.5.11-1.1.ppc64le",
          "openSUSE Tumbleweed:jupyter-jupyterlab-0:4.5.11-1.1.s390x",
          "openSUSE Tumbleweed:jupyter-jupyterlab-0:4.5.11-1.1.x86_64",
          "openSUSE Tumbleweed:python313-jupyterlab-0:4.5.11-1.1.aarch64",
          "openSUSE Tumbleweed:python313-jupyterlab-0:4.5.11-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-jupyterlab-0:4.5.11-1.1.s390x",
          "openSUSE Tumbleweed:python313-jupyterlab-0:4.5.11-1.1.x86_64",
          "openSUSE Tumbleweed:python314-jupyterlab-0:4.5.11-1.1.aarch64",
          "openSUSE Tumbleweed:python314-jupyterlab-0:4.5.11-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-jupyterlab-0:4.5.11-1.1.s390x",
          "openSUSE Tumbleweed:python314-jupyterlab-0:4.5.11-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-102904",
          "url": "https://www.suse.com/security/cve/CVE-2026-102904"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1283353 for CVE-2026-102904",
          "url": "https://bugzilla.suse.com/1283353"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:jupyter-jupyterlab-0:4.5.11-1.1.aarch64",
            "openSUSE Tumbleweed:jupyter-jupyterlab-0:4.5.11-1.1.ppc64le",
            "openSUSE Tumbleweed:jupyter-jupyterlab-0:4.5.11-1.1.s390x",
            "openSUSE Tumbleweed:jupyter-jupyterlab-0:4.5.11-1.1.x86_64",
            "openSUSE Tumbleweed:python313-jupyterlab-0:4.5.11-1.1.aarch64",
            "openSUSE Tumbleweed:python313-jupyterlab-0:4.5.11-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-jupyterlab-0:4.5.11-1.1.s390x",
            "openSUSE Tumbleweed:python313-jupyterlab-0:4.5.11-1.1.x86_64",
            "openSUSE Tumbleweed:python314-jupyterlab-0:4.5.11-1.1.aarch64",
            "openSUSE Tumbleweed:python314-jupyterlab-0:4.5.11-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-jupyterlab-0:4.5.11-1.1.s390x",
            "openSUSE Tumbleweed:python314-jupyterlab-0:4.5.11-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-01T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-102904"
    }
  ]
}

CVE-2026-102830 (GCVE-0-2026-102830)

Vulnerability from cvelistv5 – Published: 2026-09-29 18:53 – Updated: 2026-09-29 20:00

Title

JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)

Summary

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 3.0.0 until 4.5.11 and 4.6.4, and in JupyterLite Core 0.8.3 and earlier, the Plural-Forms header in a selected third-party language pack can append JavaScript after a valid plural rule because prefix-only regular-expression validation accepts a matching prefix without requiring the entire header to match. JupyterLab passes the accepted expression to new Function, so loading the catalogue and translating a plural string executes the appended code in the authenticated JupyterLab origin. Where Jupyter Server kernels, terminals, and APIs are exposed, the code can use authenticated server APIs to read or modify files and run code. Impact is much more limited in JupyterLite because it typically lacks most exposed Jupyter Server surfaces. The default English locale is unaffected because it does not load a translation catalogue. This issue is fixed in JupyterLab 4.5.11 and 4.6.4 and JupyterLite Core 0.8.4.

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-29 20:00 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

GitHub_M mitre root Scorecard

References

6 references

URL	Tags
https://github.com/jupyterlab/jupyterlab/security…	x_refsource_CONFIRM
https://github.com/jupyterlab/jupyterlab/commit/9…	x_refsource_MISC
https://github.com/jupyterlab/jupyterlab/commit/d…	x_refsource_MISC
https://github.com/jupyterlab/jupyterlab/commit/f…	x_refsource_MISC
https://github.com/jupyterlab/jupyterlab/releases…	x_refsource_MISC
https://github.com/jupyterlab/jupyterlab/releases…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version
jupyterlab	jupyterlab	Affected: >= 3.0.0, < 4.5.11 Affected: >= 4.6.0, < 4.6.4
jupyterlab	jupyterlite-core	Affected: < 0.8.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-102830",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-29T20:00:12.172481Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-29T20:00:25.547Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "jupyterlab",
          "vendor": "jupyterlab",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 4.5.11"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.6.0, \u003c 4.6.4"
            }
          ]
        },
        {
          "product": "jupyterlite-core",
          "vendor": "jupyterlab",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.8.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 3.0.0 until 4.5.11 and 4.6.4, and in JupyterLite Core 0.8.3 and earlier, the Plural-Forms header in a selected third-party language pack can append JavaScript after a valid plural rule because prefix-only regular-expression validation accepts a matching prefix without requiring the entire header to match. JupyterLab passes the accepted expression to new Function, so loading the catalogue and translating a plural string executes the appended code in the authenticated JupyterLab origin. Where Jupyter Server kernels, terminals, and APIs are exposed, the code can use authenticated server APIs to read or modify files and run code. Impact is much more limited in JupyterLite because it typically lacks most exposed Jupyter Server surfaces. The default English locale is unaffected because it does not load a translation catalogue. This issue is fixed in JupyterLab 4.5.11 and 4.6.4 and JupyterLite Core 0.8.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T18:53:19.055Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-3jqq-pw4j-pqcj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-3jqq-pw4j-pqcj"
        },
        {
          "name": "https://github.com/jupyterlab/jupyterlab/commit/985a3223cd77fd4f991cd90066342a90711d70f6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jupyterlab/jupyterlab/commit/985a3223cd77fd4f991cd90066342a90711d70f6"
        },
        {
          "name": "https://github.com/jupyterlab/jupyterlab/commit/de324ae91346c713c4f5e5485f97b6e914e0f774",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jupyterlab/jupyterlab/commit/de324ae91346c713c4f5e5485f97b6e914e0f774"
        },
        {
          "name": "https://github.com/jupyterlab/jupyterlab/commit/f9de43dc565a1118120d466117f877a189a4ce90",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jupyterlab/jupyterlab/commit/f9de43dc565a1118120d466117f877a189a4ce90"
        },
        {
          "name": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.11",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.11"
        },
        {
          "name": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.4"
        }
      ],
      "source": {
        "advisory": "GHSA-3jqq-pw4j-pqcj",
        "discovery": "UNKNOWN"
      },
      "title": "JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-102830",
    "datePublished": "2026-09-29T18:53:19.055Z",
    "dateReserved": "2026-09-29T17:25:25.265Z",
    "dateUpdated": "2026-09-29T20:00:25.547Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-102831 (GCVE-0-2026-102831)

Vulnerability from cvelistv5 – Published: 2026-09-29 18:58 – Updated: 2026-10-02 12:22

Title

JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard

Summary

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.5.0 until 4.5.11 and 4.6.4, from Notebook 7.5.0 until 7.6.3, and from JupyterLite Core 0.7.0 until 0.8.4, the system clipboard cell-paste path accepts attacker-controlled cell JSON without clearing metadata.trusted. When useSystemClipboardForCells is active and pasteCodeCellsWithoutOutput is disabled, a pasted code cell can mark HTML output as trusted, bypass output sanitization, and execute script in the authenticated JupyterLab origin without executing the cell. Markdown and raw cells are not affected because their output is sanitized. This issue is fixed in JupyterLab 4.5.11 and 4.6.4, Notebook 7.6.3, and JupyterLite Core 0.8.4.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-02 12:22 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-345 - Insufficient Verification of Data Authenticity

Assigner

GitHub_M mitre root Scorecard

References

6 references

URL	Tags
https://github.com/jupyterlab/jupyterlab/security…	x_refsource_CONFIRM
https://github.com/jupyterlab/jupyterlab/commit/1…	x_refsource_MISC
https://github.com/jupyterlab/jupyterlab/commit/7…	x_refsource_MISC
https://github.com/jupyterlab/jupyterlab/commit/c…	x_refsource_MISC
https://github.com/jupyterlab/jupyterlab/releases…	x_refsource_MISC
https://github.com/jupyterlab/jupyterlab/releases…	x_refsource_MISC

Impacted products

3 products

Vendor	Product	Version
jupyterlab	jupyterlab	Affected: >= 4.5.0, < 4.5.11 Affected: >= 4.6.0, < 4.6.4
jupyterlab	notebook	Affected: >= 7.5.0, < 7.6.3
jupyterlab	jupyterlite-core	Affected: >= 0.7.0, < 0.8.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-102831",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-02T12:22:47.366494Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-02T12:22:58.664Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "jupyterlab",
          "vendor": "jupyterlab",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.5.0, \u003c 4.5.11"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.6.0, \u003c 4.6.4"
            }
          ]
        },
        {
          "product": "notebook",
          "vendor": "jupyterlab",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 7.5.0, \u003c 7.6.3"
            }
          ]
        },
        {
          "product": "jupyterlite-core",
          "vendor": "jupyterlab",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.7.0, \u003c 0.8.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.5.0 until 4.5.11 and 4.6.4, from Notebook 7.5.0 until 7.6.3, and from JupyterLite Core 0.7.0 until 0.8.4, the system clipboard cell-paste path accepts attacker-controlled cell JSON without clearing metadata.trusted. When useSystemClipboardForCells is active and pasteCodeCellsWithoutOutput is disabled, a pasted code cell can mark HTML output as trusted, bypass output sanitization, and execute script in the authenticated JupyterLab origin without executing the cell. Markdown and raw cells are not affected because their output is sanitized. This issue is fixed in JupyterLab 4.5.11 and 4.6.4, Notebook 7.6.3, and JupyterLite Core 0.8.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-345",
              "description": "CWE-345: Insufficient Verification of Data Authenticity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T18:58:03.634Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-6966-vjj6-99xv",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-6966-vjj6-99xv"
        },
        {
          "name": "https://github.com/jupyterlab/jupyterlab/commit/1a10a7da5ff655849b21581c2633b46483ae0be9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jupyterlab/jupyterlab/commit/1a10a7da5ff655849b21581c2633b46483ae0be9"
        },
        {
          "name": "https://github.com/jupyterlab/jupyterlab/commit/7f9f29e29e0c83fb17b0f11da57d06b3c6a40d96",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jupyterlab/jupyterlab/commit/7f9f29e29e0c83fb17b0f11da57d06b3c6a40d96"
        },
        {
          "name": "https://github.com/jupyterlab/jupyterlab/commit/cf6e89a8d315c4134cefa50c220bca296da466a7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jupyterlab/jupyterlab/commit/cf6e89a8d315c4134cefa50c220bca296da466a7"
        },
        {
          "name": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.11",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.11"
        },
        {
          "name": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.4"
        }
      ],
      "source": {
        "advisory": "GHSA-6966-vjj6-99xv",
        "discovery": "UNKNOWN"
      },
      "title": "JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-102831",
    "datePublished": "2026-09-29T18:58:03.634Z",
    "dateReserved": "2026-09-29T17:25:25.266Z",
    "dateUpdated": "2026-10-02T12:22:58.664Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-102904 (GCVE-0-2026-102904)

Vulnerability from cvelistv5 – Published: 2026-09-29 20:47 – Updated: 2026-09-30 20:07

Title

JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs

Summary

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.0.0 until 4.5.11 and 4.6.4, the PyPI Extension Manager uninstall request reaches ExtensionHandler.post, which validates extension names for installation but passes uninstall names to PyPIExtensionManager.uninstall and python -m pip uninstall without rejecting option-like values. The security impact requires that the PyPI Extension Manager is enabled, the account can call the extension API, and kernels and terminals are disabled or delegated to remote hosts; otherwise the user can already read files and make outbound requests directly. An authenticated user with extension API access can supply a pip requirements option to make the server read a local file or fetch an internal URL, and reflected parse errors can return the first unparsable line or response content. A pip log option can also create or corrupt a chosen path with pip-generated log text, but the requester cannot select an arbitrary disclosed line or arbitrary file content, and the injection does not add code execution or availability impact beyond ordinary package removal. This issue is fixed in JupyterLab 4.5.11 and 4.6.4.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-30 20:06 UTC

CWE

CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
CWE-209 - Generation of Error Message Containing Sensitive Information
CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M mitre root Scorecard

References

5 references

URL	Tags
https://github.com/jupyterlab/jupyterlab/security…	x_refsource_CONFIRM
https://github.com/jupyterlab/jupyterlab/commit/a…	x_refsource_MISC
https://github.com/jupyterlab/jupyterlab/commit/e…	x_refsource_MISC
https://github.com/jupyterlab/jupyterlab/releases…	x_refsource_MISC
https://github.com/jupyterlab/jupyterlab/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
jupyterlab	jupyterlab	Affected: >= 4.0.0, < 4.5.11 Affected: >= 4.6.0, < 4.6.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-102904",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-30T20:06:56.346526Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T20:07:08.531Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "jupyterlab",
          "vendor": "jupyterlab",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.5.11"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.6.0, \u003c 4.6.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.0.0 until 4.5.11 and 4.6.4, the PyPI Extension Manager uninstall request reaches ExtensionHandler.post, which validates extension names for installation but passes uninstall names to PyPIExtensionManager.uninstall and python -m pip uninstall without rejecting option-like values. The security impact requires that the PyPI Extension Manager is enabled, the account can call the extension API, and kernels and terminals are disabled or delegated to remote hosts; otherwise the user can already read files and make outbound requests directly. An authenticated user with extension API access can supply a pip requirements option to make the server read a local file or fetch an internal URL, and reflected parse errors can return the first unparsable line or response content. A pip log option can also create or corrupt a chosen path with pip-generated log text, but the requester cannot select an arbitrary disclosed line or arbitrary file content, and the injection does not add code execution or availability impact beyond ordinary package removal. This issue is fixed in JupyterLab 4.5.11 and 4.6.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-88",
              "description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-209",
              "description": "CWE-209: Generation of Error Message Containing Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-29T20:47:43.290Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-3325-v43h-43rv",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-3325-v43h-43rv"
        },
        {
          "name": "https://github.com/jupyterlab/jupyterlab/commit/a274a8276b9185d03efd4c3c20713d3137ac49e6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jupyterlab/jupyterlab/commit/a274a8276b9185d03efd4c3c20713d3137ac49e6"
        },
        {
          "name": "https://github.com/jupyterlab/jupyterlab/commit/e277bc958e737130ac47b6c5078d08b29298828f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jupyterlab/jupyterlab/commit/e277bc958e737130ac47b6c5078d08b29298828f"
        },
        {
          "name": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.11",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.11"
        },
        {
          "name": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.4"
        }
      ],
      "source": {
        "advisory": "GHSA-3325-v43h-43rv",
        "discovery": "UNKNOWN"
      },
      "title": "JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-102904",
    "datePublished": "2026-09-29T20:47:43.290Z",
    "dateReserved": "2026-09-29T17:34:42.744Z",
    "dateUpdated": "2026-09-30T20:07:08.531Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

OPENSUSE-SU-2026:11945-1

CVE-2026-102830 (GCVE-0-2026-102830)

CVE-2026-102831 (GCVE-0-2026-102831)

CVE-2026-102904 (GCVE-0-2026-102904)

Tags

Sightings

Nomenclature

Related by attack behaviour