{"schema_version":"1","data":[{"id":20351,"advisory_id":"3effd6f0-b211-41ee-a8be-fa1a7d9bd564","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102832","source_published_at":"2026-10-13T15:19:40.699+00:00","published_at":"2026-10-25T05:26:41.904397+00:00","extraction_method":"structured","technologies":["core-cve","jupyterlab","jupyterlite-core","notebook"],"cve_ids":["CVE-2026-102832"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked","summary":"JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.7 until 4.5.11 and 4.6.4, the markdownviewer:trust and notebook:trust command-link handlers use tracker.currentWidget to resolve the current Markdown viewer or notebook when the user answers rather than retaining the document whose command button was clicked. If another document becomes current while the prompt is open and the user chooses Trust, JupyterLab marks the second document trusted while leaving the clicked document untrusted. Later command buttons in the incorrectly trusted document run without a prompt, and trusting a notebook marks all cells trusted, saves unsaved edits, and persists the server signature to disk. Applications that bundle JupyterLab, including affected Notebook and JupyterLite releases, inherit the behavior. This issue is fixed in versions 4.5.11 and 4.6.4.","evidence":"cve:CVE-2026-102832","products":[{"name":{"value":"jupyterlab","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"jupyterlite-core","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"notebook","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-102832","aliases":["CVE-2026-102832"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.2,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"jupyterlab","product":"jupyterlab","versions":[{"status":"affected","version":">= 4.5.7, < 4.5.11"},{"status":"affected","version":">= 4.6.0, < 4.6.4"}]},{"vendor":"jupyterlab","product":"jupyterlite-core","versions":[{"status":"affected","version":">= 0.7.5, < 0.8.4"}]},{"vendor":"jupyterlab","product":"notebook","versions":[{"status":"affected","version":">= 7.5.6, < 7.6.3"}]}],"modified":"2026-10-13T16:09:02.990Z","provider":"cve","references":["https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-jwrc-gm9j-263p","https://github.com/jupyterlab/jupyterlab/commit/0fc18ab4ef67e431a8f6560e387193baf786c70a","https://github.com/jupyterlab/jupyterlab/commit/b64bc88b8ca034cf158604a5cc48ca9170ea453b","https://github.com/jupyterlab/jupyterlab/commit/f7e5f9803fdf2aaaa0e9bfb9cc73386a8cc5f0b2","https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.11","https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.4"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102832","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-13T16:08:53.454501Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-13T16:09:02.990Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-13T15:19:40.699Z"}}},"related_cves":[{"value":"CVE-2026-102832","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":12812,"advisory_id":"adae6cb4-2163-4d3b-b266-476fc189a1ac","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-67338","source_published_at":"2026-08-01T12:22:17.437+00:00","published_at":"2026-10-25T00:13:58.813042+00:00","extraction_method":"structured","technologies":["core-cve","jupyterlab"],"cve_ids":["CVE-2026-67338"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"JupyterLab before 4.5.9 Stored XSS via Extension Manager","summary":"JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the JupyterLab origin when users click the extension name.","evidence":"cve:CVE-2026-67338","products":[{"name":{"value":"jupyterlab","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-67338","aliases":["CVE-2026-67338"],"metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":5.1,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"LOW","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":6.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"jupyterlab","product":"jupyterlab","versions":[{"status":"affected","version":"0","lessThan":"4.5.9","versionType":"semver"},{"status":"unaffected","version":"4.5.9","versionType":"semver"}],"packageURL":"pkg:pypi/jupyterlab","defaultStatus":"unaffected"}],"modified":"2026-10-08T15:24:13.033Z","provider":"cve","references":["https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-vmhf-c436-hxj4","https://github.com/jupyterlab/jupyterlab/commit/4e61e07d0a91145b53fbf96ac74b0387f6bc51f6","https://github.com/jupyterlab/jupyterlab/commit/d5d961f6e10a6442dddbf94d9a976b3897055a12","https://www.vulncheck.com/advisories/jupyterlab-before-stored-xss-via-extension-manager"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-67338","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-08-03T19:36:31.254675Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-03T19:36:40.296Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-08T15:24:13.033Z"}}},"related_cves":[{"value":"CVE-2026-67338","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":7900,"advisory_id":"06a55e6c-2adb-42d9-ba76-6f2de535d8af","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102831","source_published_at":"2026-09-29T18:58:03.634+00:00","published_at":"2026-10-24T22:52:24.322513+00:00","extraction_method":"structured","technologies":["core-cve","jupyterlab","jupyterlite-core","notebook"],"cve_ids":["CVE-2026-102831"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard","summary":"JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.5.0 until 4.5.11 and 4.6.4, from Notebook 7.5.0 until 7.6.3, and from JupyterLite Core 0.7.0 until 0.8.4, the system clipboard cell-paste path accepts attacker-controlled cell JSON without clearing metadata.trusted. When useSystemClipboardForCells is active and pasteCodeCellsWithoutOutput is disabled, a pasted code cell can mark HTML output as trusted, bypass output sanitization, and execute script in the authenticated JupyterLab origin without executing the cell. Markdown and raw cells are not affected because their output is sanitized. This issue is fixed in JupyterLab 4.5.11 and 4.6.4, Notebook 7.6.3, and JupyterLite Core 0.8.4.","evidence":"cve:CVE-2026-102831","products":[{"name":{"value":"jupyterlab","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"notebook","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"jupyterlite-core","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102831","aliases":["CVE-2026-102831"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"jupyterlab","product":"jupyterlab","versions":[{"status":"affected","version":">= 4.5.0, < 4.5.11"},{"status":"affected","version":">= 4.6.0, < 4.6.4"}]},{"vendor":"jupyterlab","product":"notebook","versions":[{"status":"affected","version":">= 7.5.0, < 7.6.3"}]},{"vendor":"jupyterlab","product":"jupyterlite-core","versions":[{"status":"affected","version":">= 0.7.0, < 0.8.4"}]}],"modified":"2026-10-02T12:22:58.664Z","provider":"cve","references":["https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-6966-vjj6-99xv","https://github.com/jupyterlab/jupyterlab/commit/1a10a7da5ff655849b21581c2633b46483ae0be9","https://github.com/jupyterlab/jupyterlab/commit/7f9f29e29e0c83fb17b0f11da57d06b3c6a40d96","https://github.com/jupyterlab/jupyterlab/commit/cf6e89a8d315c4134cefa50c220bca296da466a7","https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.11","https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.4"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102831","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-02T12:22:47.366494Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-02T12:22:58.664Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-29T18:58:03.634Z"}}},"related_cves":[{"value":"CVE-2026-102831","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":4895,"advisory_id":"3e454223-8800-45d3-83d6-49e27a0f3217","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102904","source_published_at":"2026-09-29T20:47:43.29+00:00","published_at":"2026-10-24T21:59:19.495296+00:00","extraction_method":"structured","technologies":["core-cve","jupyterlab"],"cve_ids":["CVE-2026-102904"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs","summary":"JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.0.0 until 4.5.11 and 4.6.4, the PyPI Extension Manager uninstall request reaches ExtensionHandler.post, which validates extension names for installation but passes uninstall names to PyPIExtensionManager.uninstall and python -m pip uninstall without rejecting option-like values. The security impact requires that the PyPI Extension Manager is enabled, the account can call the extension API, and kernels and terminals are disabled or delegated to remote hosts; otherwise the user can already read files and make outbound requests directly. An authenticated user with extension API access can supply a pip requirements option to make the server read a local file or fetch an internal URL, and reflected parse errors can return the first unparsable line or response content. A pip log option can also create or corrupt a chosen path with pip-generated log text, but the requester cannot select an arbitrary disclosed line or arbitrary file content, and the injection does not add code execution or availability impact beyond ordinary package removal. This issue is fixed in JupyterLab 4.5.11 and 4.6.4.","evidence":"cve:CVE-2026-102904","products":[{"name":{"value":"jupyterlab","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-102904","aliases":["CVE-2026-102904"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"jupyterlab","product":"jupyterlab","versions":[{"status":"affected","version":">= 4.0.0, < 4.5.11"},{"status":"affected","version":">= 4.6.0, < 4.6.4"}]}],"modified":"2026-09-30T20:07:08.531Z","provider":"cve","references":["https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-3325-v43h-43rv","https://github.com/jupyterlab/jupyterlab/commit/a274a8276b9185d03efd4c3c20713d3137ac49e6","https://github.com/jupyterlab/jupyterlab/commit/e277bc958e737130ac47b6c5078d08b29298828f","https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.11","https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.4"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102904","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-30T20:06:56.346526Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T20:07:08.531Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-29T20:47:43.290Z"}}},"related_cves":[{"value":"CVE-2026-102904","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":4766,"advisory_id":"eea80812-1287-483b-87fe-0777a9d3f5c5","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-73627","source_published_at":"2026-08-13T11:28:26.249+00:00","published_at":"2026-10-24T21:56:56.740743+00:00","extraction_method":"structured","technologies":["core-cve","jupyterlab"],"cve_ids":["CVE-2026-73627"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"JupyterLab 4.6.0 Plugin Manager Lock-Rule Enforcement Bypass","summary":"JupyterLab (pip package 'jupyterlab') versions >=4.1.0,<=4.5.9 and >=4.6.0,<=4.6.1 contain a plugin manager lock-rule enforcement bypass. Two server-side enforcement gaps allow an authenticated user to circumvent administrator lock rules by making direct requests to the /lab/api/plugins endpoint, enabling or disabling plugins that were locked — including child plugins of multi-plugin extensions and plugins locked via the 'lock all' mechanism. This can impact data integrity and bypass hardening or restrictions (e.g., download/upload limits) implemented through locked plugins. Fixed in versions 4.6.2 and 4.5.10.","evidence":"cve:CVE-2026-73627","products":[{"name":{"value":"jupyterlab","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"jupyterlab","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-73627","aliases":["CVE-2026-73627"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}}],"affected":[{"vendor":"jupyterlab","product":"jupyterlab","versions":[{"status":"affected","version":"4.6.0","versionType":"semver","lessThanOrEqual":"4.6.1"}],"packageURL":"pkg:pypi/jupyterlab","defaultStatus":"unaffected"},{"vendor":"jupyterlab","product":"jupyterlab","versions":[{"status":"affected","version":"4.1.0","versionType":"semver","lessThanOrEqual":"4.5.9"}],"packageURL":"pkg:pypi/jupyterlab","defaultStatus":"unaffected"}],"modified":"2026-09-30T17:20:27.405Z","provider":"cve","references":["https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-h5v5-8746-g7mm","https://www.vulncheck.com/advisories/jupyterlab-plugin-manager-lock-rule-enforcement-bypass"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-73627","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-08-15T03:13:31.123307Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-08-15T03:13:40.300Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-09-30T17:20:27.405Z"}}},"related_cves":[{"value":"CVE-2026-73627","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":4003,"advisory_id":"e0c3a0f6-bab3-4040-b9ad-09295defa640","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102830","source_published_at":"2026-09-29T18:53:19.055+00:00","published_at":"2026-10-24T21:44:50.169298+00:00","extraction_method":"structured","technologies":["core-cve","jupyterlab","jupyterlite-core"],"cve_ids":["CVE-2026-102830"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)","summary":"JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 3.0.0 until 4.5.11 and 4.6.4, and in JupyterLite Core 0.8.3 and earlier, the Plural-Forms header in a selected third-party language pack can append JavaScript after a valid plural rule because prefix-only regular-expression validation accepts a matching prefix without requiring the entire header to match. JupyterLab passes the accepted expression to new Function, so loading the catalogue and translating a plural string executes the appended code in the authenticated JupyterLab origin. Where Jupyter Server kernels, terminals, and APIs are exposed, the code can use authenticated server APIs to read or modify files and run code. Impact is much more limited in JupyterLite because it typically lacks most exposed Jupyter Server surfaces. The default English locale is unaffected because it does not load a translation catalogue. This issue is fixed in JupyterLab 4.5.11 and 4.6.4 and JupyterLite Core 0.8.4.","evidence":"cve:CVE-2026-102830","products":[{"name":{"value":"jupyterlab","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"jupyterlite-core","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-102830","aliases":["CVE-2026-102830"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"jupyterlab","product":"jupyterlab","versions":[{"status":"affected","version":">= 3.0.0, < 4.5.11"},{"status":"affected","version":">= 4.6.0, < 4.6.4"}]},{"vendor":"jupyterlab","product":"jupyterlite-core","versions":[{"status":"affected","version":"< 0.8.4"}]}],"modified":"2026-09-29T20:00:25.547Z","provider":"cve","references":["https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-3jqq-pw4j-pqcj","https://github.com/jupyterlab/jupyterlab/commit/985a3223cd77fd4f991cd90066342a90711d70f6","https://github.com/jupyterlab/jupyterlab/commit/de324ae91346c713c4f5e5485f97b6e914e0f774","https://github.com/jupyterlab/jupyterlab/commit/f9de43dc565a1118120d466117f877a189a4ce90","https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.11","https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.4"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102830","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-29T20:00:12.172481Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T20:00:25.547Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-29T18:53:19.055Z"}}},"related_cves":[{"value":"CVE-2026-102830","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}}],"next_after":20351,"next_before":4003}