JupyterLab EUVD-2026-89337

Exploitation requires a victim to install AND activate a malicious or tampered third-party JupyterLab language pack (locale/translation catalogue); the default English locale is unaffected because it loads no catalogue. The Plural-Forms header must carry a valid plural rule as a matching prefix followed by appended JavaScript, which the prefix-only regex (missing end-anchor) accepts and passes to new Function. Full server-side impact (file read/modify, code execution) additionally requires that Jupyter Server kernels, terminals, and APIs are exposed to the JupyterLab origin - in JupyterLite these surfaces are typically absent, sharply limiting impact. Limiting factors: high attack complexity (crafted locale must be delivered and chosen by the user), required user interaction (locale selection), and dependence on a non-default third-party language pack.

The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) yields 6.8 (Medium) and is internally consistent with the description: exploitation is network-reachable but requires both a high-complexity precondition (the victim must select a malicious third-party language pack) and user interaction (UI:R). No EPSS score, KEV listing, or public POC is present in the input, so this is 'no public exploit identified at time of analysis' - though the fix commit ships a regression test (985a3223) that demonstrates the injection primitive (globalThis.__jupyterLabTranslationXss = true;), which is effectively a proof of the technique but not a weaponized exploit. There is no signal conflict: the low real-world exploitation likelihood stems from the multi-step social/supply-chain requirement (attacker must get a victim to install and activate a crafted locale pack), not from any contradiction in the data. This is best treated as a legitimate but non-emergency patch priority: a genuine code-injection-in-authenticated-origin flaw whose blast radius (read/modify files, run kernel code via authenticated Jupyter Server APIs) is severe, but whose trigger conditions make mass or opportunistic exploitation unlikely. Impact is materially lower on JupyterLite, which usually lacks the exposed Jupyter Server surfaces.

An attacker publishes or tampers with a third-party JupyterLab language pack whose Plural-Forms header contains a valid plural rule followed by appended JavaScript. A user installs and selects that locale; when JupyterLab loads the catalogue and translates any plural string, the appended code runs via new Function in the authenticated JupyterLab origin, letting it call authenticated Jupyter Server APIs to read/modify files and execute code on the server. No public weaponized exploit is identified, though the vendor fix includes a regression test proving the injection.