Is CVE-2026-102830 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-102830 being exploited in the wild.

How severe is CVE-2026-102830?

Medium severity, with a CVSS score of 6.8, published 29 September 2026.

Which products and versions are affected?

Project Jupyter JupyterLab 3.0.0 to 4.5.10, 4.6.0 to 4.6.3; Project Jupyter JupyterLite Core 0.8.3 and earlier; jupyterlab (PyPI) ECOSYSTEM:introduced=3.0.0,fixed=4.5.11,introduced=4.6.0,fixed=4.6.4, ECOSYSTEM:introduced=4.6.0,fixed=4.6.4; jupyterlite-core (PyPI) ECOSYSTEM:introduced=0,fixed=0.8.4.

Is there a fix for CVE-2026-102830?

Yes. jupyterlab (PyPI): upgrade to 4.6.4 or later; jupyterlite-core (PyPI): upgrade to 0.8.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-102830 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-102830?

Check whether you run Project Jupyter JupyterLab, Project Jupyter JupyterLite Core, jupyterlab (PyPI) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102830: JupyterLab code injection via Plural-Forms header in language pack

CVE-2026-102830 · Severity: medium · CVSS 6.8 · Published 2026-09-29

JupyterLab, an interactive computing environment, contains a code injection vulnerability in its translation system. An attacker can craft a malicious language pack with a specially crafted Plural-Forms header that bypasses validation and executes arbitrary JavaScript in the authenticated user's session. This allows unauthorized access to files and execution of code with the user's privileges on the connected Jupyter Server.

Technologies: Project Jupyter JupyterLab, jupyterlab (PyPI), jupyterlite-core (PyPI). Vendors: Project Jupyter, PyPI.

Quick answers

Is CVE-2026-102830 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-102830 being exploited in the wild.
How severe is CVE-2026-102830?: Medium severity, with a CVSS score of 6.8, published 29 September 2026.
Which products and versions are affected?: Project Jupyter JupyterLab 3.0.0 to 4.5.10, 4.6.0 to 4.6.3; Project Jupyter JupyterLite Core 0.8.3 and earlier; jupyterlab (PyPI) ECOSYSTEM:introduced=3.0.0,fixed=4.5.11,introduced=4.6.0,fixed=4.6.4, ECOSYSTEM:introduced=4.6.0,fixed=4.6.4; jupyterlite-core (PyPI) ECOSYSTEM:introduced=0,fixed=0.8.4.
Is there a fix for CVE-2026-102830?: Yes. jupyterlab (PyPI): upgrade to 4.6.4 or later; jupyterlite-core (PyPI): upgrade to 0.8.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-102830 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-102830?: Check whether you run Project Jupyter JupyterLab, Project Jupyter JupyterLite Core, jupyterlab (PyPI) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

jupyterlab (PyPI): upgrade to 4.6.4 or later
```
pip install "jupyterlab>=4.6.4"
```
jupyterlite-core (PyPI): upgrade to 0.8.4 or later
```
pip install "jupyterlite-core>=0.8.4"
```

Technical details

The vulnerability exists in JupyterLab's translation catalogue loader, which uses prefix-only regex validation on the Plural-Forms header in language packs, allowing attackers to append arbitrary JavaScript after a valid plural rule. The compromised header is passed to new Function() for execution, resulting in arbitrary code execution in the authenticated JupyterLab origin. This requires user interaction to load a malicious translation catalogue and is limited to authenticated sessions with access to Jupyter Server APIs.

Affected products

Project Jupyter JupyterLab 3.0.0 to 4.5.10, 4.6.0 to 4.6.3
Project Jupyter JupyterLite Core 0.8.3 and earlier

Identifiers

CVE-2026-102830
GHSA-3jqq-pw4j-pqcj
PYSEC-2026-4056
PYSEC-2026-4059

Timeline

2026-09-29: disclosed: CVE-2026-102830 published
2026-09-29: patched: Fixed in JupyterLab 4.5.11, 4.6.4, and JupyterLite Core 0.8.4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.