Live data from GitHub and PyPI, updated daily.
Data last fetched: 2026-10-22
10 active CVEs reported via OSV.dev
JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs
JupyterLab has an Extension Manager API/GUI Policy Discrepancy, allowing 3rd party (malicious) extensions install via POST request
JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)
JupyterLab vulnerable to potential authentication and CSRF tokens leak
JupyterLab: XSS due to lack of sanitization of the action attribute of an html <form>
JupyterLab vulnerable to SXSS in Markdown Preview
JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard
JupyterLab: PyPI extension blocklist package-name canonicalization bypass
HTML injection in Jupyter Notebook and JupyterLab leading to DOM Clobbering
JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab
Other Developer Tools projects in the Python ecosystem worth evaluating.
Get SLA-backed support, security patches, and direct access to senior engineers for JupyterLab — without relying on volunteer maintainers.