Executive brief
HTML injection in Jupyter Notebook and JupyterLab leading to DOM Clobbering
Affected products
- PyPI notebook
- PyPI jupyterlab
Junglewise Threat Intelligence
CVE-2024-43805: PYSEC-2026-2536 - HTML injection in Jupyter Notebook and JupyterLab leading to DOM Clobbering
CVE-2024-43805 · Severity: low · CVSS 3.1 · Published 2026-07-13
Technologies: notebook (PyPI), jupyterlab (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-3671 - JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab
- JupyterLab arbitrary code execution via malicious overrides.json
- JupyterLab extension blocklist bypass via package name variant
- PYSEC-2026-2682 - Jupyter Notebook Vulnerable to Authentication Token Theft via CommandLinker XSS
- PYSEC-2026-2534 - JupyterLab vulnerable to potential authentication and CSRF tokens leak