Is CVE-2026-67338 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-67338 being exploited in the wild.

How severe is CVE-2026-67338?

Medium severity, with a CVSS score of 6.1, published 1 August 2026.

Which products and versions are affected?

jupyterlab (PyPI) ECOSYSTEM:introduced=0,fixed=4.5.9.

Is there a fix for CVE-2026-67338?

Yes. jupyterlab (PyPI): upgrade to 4.5.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-67338 attacked?

It is attacked over the network.

Am I affected by CVE-2026-67338?

Check whether you run jupyterlab (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-67338: JupyterLab stored cross-site scripting in Extension Manager

CVE-2026-67338 · Severity: medium · CVSS 6.1 · Published 2026-08-01

JupyterLab's Extension Manager is a feature that allows users to discover and install extensions to enhance the notebook environment. A vulnerability in the Extension Manager fails to validate protocol types in package metadata URLs, allowing an attacker to publish a malicious PyPI package with JavaScript execution code embedded in the project metadata. When a user clicks on the extension name, arbitrary JavaScript executes in the JupyterLab application context, potentially leading to credential theft, data exfiltration, or unauthorized actions.

Technologies: jupyterlab (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-67338 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-67338 being exploited in the wild.
How severe is CVE-2026-67338?: Medium severity, with a CVSS score of 6.1, published 1 August 2026.
Which products and versions are affected?: jupyterlab (PyPI) ECOSYSTEM:introduced=0,fixed=4.5.9.
Is there a fix for CVE-2026-67338?: Yes. jupyterlab (PyPI): upgrade to 4.5.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-67338 attacked?: It is attacked over the network.
Am I affected by CVE-2026-67338?: Check whether you run jupyterlab (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

jupyterlab (PyPI): upgrade to 4.5.9 or later
```
pip install "jupyterlab>=4.5.9"
```

Technical details

This is a stored cross-site scripting (XSS) vulnerability in JupyterLab's Extension Manager component, specifically in the `homepage_url` field handling within package metadata. The vulnerability arises from insufficient URI protocol validation when rendering extension names as clickable links. An attacker can publish a malicious PyPI package with a `javascript:` URL in the project metadata; when a JupyterLab user clicks the extension name link, the JavaScript URL executes in the JupyterLab origin context. No user authentication is required; exploitation requires that a user install and view a malicious extension in the Extension Manager. The fix restricts allowed URL protocols (e.g., to http/https only) and forbids relative URLs to prevent JavaScript protocol execution. Patches are available in JupyterLab 4.5.9 and later.

Affected products

JupyterLab JupyterLab before 4.5.9

Identifiers

CVE-2026-67338
GHSA-vmhf-c436-hxj4

Timeline

2026-08-01: disclosed
2026: patched: Fix released in JupyterLab 4.5.9

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.