CVE-2024-39700Critical· 9.8▾ AbyssalPoC availableJupyterLab extension template is a `copier` template for JupyterLab extensions. Repositories created using this template with `test` option include `update-integration-tests.yml` workflow which has an RCE vulnerability. Extension author…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 53.9 · likelihood 0.2 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Jul 31.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
1.0%
2 GitHub repos
1.0% → 1.1%
JupyterLab extension template is a copier template for JupyterLab extensions. Repositories created using this template with test option include update-integration-tests.yml workflow which has an RCE vulnerability. Extension authors hosting their code on GitHub are urged to upgrade the template to the latest version. Users who made changes to update-integration-tests.yml, accept overwriting of this file and re-apply your changes later. Users may wish to temporarily disable GitHub Actions while working on the upgrade. We recommend rebasing all open pull requests from untrusted users as actions may run using the version from the main branch at the time when the pull request was created. Users who are upgrading from template version prior to 4.3.0 may wish to leave out proposed changes to the release workflow for now as it requires additional configuration.
jupyterlab < 4.3.0Upgrade to a patched release:
jupyterlab 4.3.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-102832Medium· 4.2JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture
CVE-2026-102904Medium· 5.4JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture
CVE-2026-102830Medium· 6.8JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture
CVE-2026-102831High· 8.1JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture
CVE-2026-73626High· 7.5JupyterLab versions >=4.6.0,<=4.6.1 and <=4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install()
CVE-2026-73417High· 8.3jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture