A flaw was found in JupyterLab. Incomplete validation of language pack headers allows arbitrary JavaScript code to be injected and executed during string translation. An attacker could exploit this flaw by enticing a user to load a malicious third-party language pack, resulting in code execution within the authenticated user's session. This allows an attacker to interact with exposed server application programming interfaces (APIs) to read or modify files and execute commands.
Last checked: 2026-09-29 22:54 UTC
No exploitation evidence · CISA Coordinator (Assessed 2026-09-29 20:00 UTC)
Fix evidence last checked: 2026-10-06 10:29 UTC