CVE-2026-67338: JupyterLab XSS Vulnerability

CVE-2026-67338 Overview

CVE-2026-67338 is a stored cross-site scripting (XSS) vulnerability in JupyterLab versions before 4.5.9. The flaw resides in the Extension Manager, which fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages containing javascript: URLs in the project metadata homepage_url field. When a JupyterLab user browses the Extension Manager and clicks the extension name, the crafted URL executes arbitrary JavaScript in the JupyterLab origin. The weakness is classified as [CWE-84] (Improper Neutralization of Encoded URI Schemes in a Web Page).

Critical Impact
Arbitrary JavaScript execution within the authenticated JupyterLab origin, enabling notebook data theft, session abuse, and pivoting to attached kernels.

Affected Products

JupyterLab versions prior to 4.5.9
JupyterLab Extension Manager component (packages/extensionmanager/src/widget.tsx)
Deployments that expose the Extension Manager UI to end users

Discovery Timeline

2026-08-01 - CVE-2026-67338 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-67338

Vulnerability Analysis

JupyterLab's Extension Manager renders extension metadata pulled from package indexes such as PyPI. The UI turns the homepage_url field into a clickable anchor tag without restricting the URI scheme. Any attacker who can publish a package to a queried index can set homepage_url to a javascript: URI. When a JupyterLab user clicks the extension name, the browser evaluates the payload in the JupyterLab origin. Because JupyterLab hosts authenticated sessions, cookies, and kernel APIs on that origin, injected script can read notebook contents, issue REST calls to the Jupyter Server, and execute code through attached kernels.

Root Cause

The Extension Manager widget did not enforce an allow-list of URI protocols before assigning user-controlled values to anchor href attributes. The homepage_url string from package metadata flowed directly into the DOM, allowing non-HTTP schemes to remain intact. This is a classic sink-side validation gap tracked under [CWE-84].

Attack Vector

Exploitation requires an attacker to publish a package with malicious metadata to a package registry queried by the Extension Manager, then wait for an authenticated JupyterLab user to view and click the entry. The attack is network-reachable and requires user interaction but no elevated privileges on the target instance.

tsx

// Security patch in packages/extensionmanager/src/widget.tsx
// Fix XSS in extension manager's homepage_url (#19003)
   return null;
 }
 
+function isProtocolAllowed(url: string): boolean {
+  try {
+    const parsed = new URL(url, window.location.href);
+    const protocol = parsed.protocol.toLowerCase();
+    return ['http:', 'https:'].includes(protocol);
+  } catch {
+    return false;
+  }
+}
+
 /**
  * VDOM for visualizing an extension entry.
  */

Source: GitHub Commit 4e61e07

A follow-up commit hardened the check by rejecting relative URLs, which could otherwise inherit a permissive base and bypass the protocol filter:

tsx

// Follow-up patch - Forbid relative URLs in extensionmanager (#19013)
 function isProtocolAllowed(url: string): boolean {
   try {
-    const parsed = new URL(url, window.location.href);
+    const parsed = new URL(url);
     const protocol = parsed.protocol.toLowerCase();
     return ['http:', 'https:'].includes(protocol);
   } catch {

Source: GitHub Commit d5d961f

Detection Methods for CVE-2026-67338

Indicators of Compromise

Extension entries in the Extension Manager UI whose homepage URL uses a non-HTTP scheme such as javascript:, data:, or vbscript:.
Outbound HTTP requests from JupyterLab browser sessions to unexpected domains immediately after a user opens the Extension Manager.
New or unusual notebook file writes, token exfiltration, or kernel executions originating from a browser tab shortly after visiting the Extension Manager.

Detection Strategies

Audit locally installed JupyterLab versions and flag any instance below 4.5.9.
Inspect PyPI (or private index) metadata for homepage_url values that fail an http:/https: protocol check.
Deploy a Content Security Policy (CSP) that forbids inline script and javascript: URIs, and alert on CSP violation reports from the JupyterLab origin.

Monitoring Recommendations

Log and review Jupyter Server access patterns for anomalous API calls that follow Extension Manager usage.
Monitor browser telemetry or endpoint EDR for scripts executing under the JupyterLab origin that touch kernel or file APIs unexpectedly.
Track package index query traffic from JupyterLab hosts to identify newly indexed packages that could seed a stored XSS payload.

How to Mitigate CVE-2026-67338

Immediate Actions Required

Upgrade JupyterLab to version 4.5.9 or later on all user workstations, shared servers, and JupyterHub deployments.
Restart Jupyter Server processes and force browser refreshes so users load the patched Extension Manager assets.
Notify users to avoid interacting with the Extension Manager until the upgrade completes.

Patch Information

The fix is delivered in JupyterLab 4.5.9. The core change introduces an isProtocolAllowed helper that restricts anchor URLs to http: and https: schemes, with a follow-up commit rejecting relative URLs. Full details are documented in GitHub Security Advisory GHSA-vmhf-c436-hxj4 and the VulnCheck Advisory for JupyterLab.

Workarounds

Disable the Extension Manager in environments where upgrading immediately is not possible by setting jupyter labextension disable @jupyterlab/extensionmanager-extension.
Restrict the Extension Manager to trusted package indexes via PageConfig settings that constrain the queried listings source.
Enforce a strict CSP on the JupyterLab origin to block execution of javascript: URIs even if metadata sanitization fails.

bash

# Configuration example - disable the vulnerable Extension Manager UI
jupyter labextension disable @jupyterlab/extensionmanager-extension

# Verify JupyterLab version is patched
jupyter lab --version    # should report 4.5.9 or later

# Upgrade via pip
pip install --upgrade "jupyterlab>=4.5.9"