Betroffene Versionslinien
Bekannte Schwachstellen
| CVE | Titel | Betroffene Versionen | CVSS | Ausgenutzt | EPSS | Veröffentlicht |
|---|---|---|---|---|---|---|
| CVE-2026-102832 | JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked | * | 4.2 | — | 2026-10-14 | |
| CVE-2026-102904 | JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal UR... | * | 5.4 | — | 2026-09-30 | |
| CVE-2026-102831 | JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard | * | 8.1 | — | 2026-09-30 | |
| CVE-2026-102830 | JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json) | * | 6.8 | — | 2026-09-30 | |
| CVE-2026-73417 | JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`) | * | 8.6 | — | 2026-08-14 | |
| CVE-2026-73416 | jupyterlab: PyPI extension blocklist package-name canonicalization bypass | * | 6.1 | — | 2026-08-14 | |
| CVE-2026-73627 | JupyterLab 4.6.0 Plugin Manager Lock-Rule Enforcement Bypass | ≥ 4.6.0 ≤ 4.6.1 ≥ 4.1.0 ≤ 4.5.9 | 6.0 | — | 2026-08-13 | |
| CVE-2026-73626 | JupyterLab before 4.6.2 Authentication Bypass via PyPIExtensionManager | ≥ 4.6.0 < 4.6.1 < 4.5.10 | 7.7 | — | 2026-08-13 | |
| CVE-2026-73415 | jupyterlab: Image viewer in JupyterLab allows XSS when opening malicious image in new browser tab | * | 7.5 | — | 2026-08-13 | |
| CVE-2026-67338 | JupyterLab before 4.5.9 Stored XSS via Extension Manager | < 4.5.9 | 5.1 | — | 2026-08-01 | |
| CVE-2026-42266 | JupyterLab has an Extension Manager API/GUI Policy Discrepancy allowing 3rd party (malicious) extensions insta... | * | 8.8 | — | 2026-05-14 | |
| CVE-2026-42557 | jupyterlab: Command linker attributes in HTML enable one-click command execution from untrusted content | * | 8.6 | — | 2026-05-14 | |
| CVE-2026-40171 | Jupyter Notebook and JupyterLab token theft via stored XSS in help command linker | * | 8.4 | — | 2026-05-07 | |
| CVE-2025-59842 | JupyterLab LaTeX typesetter links did not enforce `noopener` attribute | * | 2.1 | — | 2025-09-27 | |
| CVE-2024-43805 | HTML injection in Jupyter Notebook and JupyterLab leading to DOM Clobbering | * | 7.6 | — | 2024-08-29 | |
| CVE-2024-22420 | Stored cross site scripting in Markdown Preview in JupyterLab | * | 6.5 | — | 2024-01-20 | |
| CVE-2024-22421 | Potential authentication and CSRF tokens leak in JupyterLab | * | 7.6 | — | 2024-01-20 | |
| CVE-2021-32797 | JupyterLab: XSS due to lack of sanitization of the action attribute of an html <form> | * | 7.4 | — | 2021-08-10 |
Verfolgen Sie diese Versionen auf Ihren eigenen Servern
InfraGuard erfasst die installierten Softwareversionen auf jedem Server und markiert diejenigen mit bekannten Schwachstellen. Self-Hosted – nichts verlässt Ihr Netzwerk.
Daten: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (siehe EPSS unter https://www.first.org/epss), endoflife.date. Softwareliste: awesome-selfhosted (CC BY-SA 3.0).