Linux Distros Unpatched Vulnerability : CVE-2026-67338

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata...

DEBIAN-CVE-2026-67338

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...

xircuits (>=1.0.0, <=1.2.0) potentially affected by CVE-2026-67338 via jupyterlab (3.1.10)

jupyterlab PYPI version 3.1.10 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - xircuits =1.0.0, =1.2.0 Source cves: CVE-2026-67338 Source advisory: OSV:GHSA-VMHF-C436-HXJ4...

aalto-gpu (0.1.0), ballet-assemble (>=0.8.2, <=0.8.8) +41 more potentially affected by CVE-2026-67338 via jupyterlab (2.3.2)

jupyterlab PYPI version 2.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - aalto-gpu 0.1.0 - ballet-assemble =0.8.2, =1.0.0rc1, =1.3.1, =1.3.1, =1.3.1, =1.3.1, =0.1.0, =0.0.2, =1.31.6, =0.1.0, =0.3.0, =0.3.0, =0.5.0...

dimbridge (0.2.0) potentially affected by CVE-2026-67338 via jupyterlab (3.0.0)

jupyterlab PYPI version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - dimbridge 0.2.0 Source cves: CVE-2026-67338 Source advisory: OSV:GHSA-VMHF-C436-HXJ4...

rlai (>=0.16.0, <=1.0.0) potentially affected by CVE-2026-67338 via jupyterlab (3.0.6)

jupyterlab PYPI version 3.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - rlai =0.16.0, =1.0.0 Source cves: CVE-2026-67338 Source advisory: OSV:GHSA-VMHF-C436-HXJ4...

colabcode (>=0.2.0, <=0.3.0), colabcodemodbybitgeek29 (29.1.0) potentially affected by CVE-2026-67338 via jupyterlab (3.0.7)

jupyterlab PYPI version 3.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - colabcode =0.2.0, =0.3.0 - colabcodemodbybitgeek29 29.1.0 Source cves: CVE-2026-67338 Source advisory: OSV:GHSA-VMHF-C436-HXJ4...

aplusml (>=0.1.0, <=0.3.1), nbsv (0.1.6) +1 more potentially affected by CVE-2026-67338 via jupyterlab (3.5.2)

jupyterlab PYPI version 3.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - aplusml =0.1.0, =0.3.1 - nbsv 0.1.6 - uptrain 0.1.0.dev0 Source cves: CVE-2026-67338 Source advisory: OSV:GHSA-VMHF-C436-HXJ4...

coiled-runtime (>=0.2.0, <=0.2.1), here-search-demo (>=0.8.0, <=0.8.5) +5 more potentially affected by CVE-2026-67338 via jupyterlab (3.5.0)

jupyterlab PYPI version 3.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - coiled-runtime =0.2.0, =0.8.0, =0.2.0b2, =1.0.0, =0.0.3, =1.0.0a20, =1.0.1, =1.0.1.6 Source cves: CVE-2026-67338 Source advisory:...

jupyterlab-unfold (>=0.1.0, <=0.1.2) potentially affected by CVE-2026-67338 via jupyterlab (3.1.0a10)

jupyterlab PYPI version 3.1.0a10 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - jupyterlab-unfold =0.1.0, =0.1.2 Source cves: CVE-2026-67338 Source advisory: OSV:GHSA-VMHF-C436-HXJ4...

jupyterlab-scheduler (>=0.1.4, <=0.1.5) potentially affected by CVE-2026-67338 via jupyterlab (3.1.19)

jupyterlab PYPI version 3.1.19 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - jupyterlab-scheduler =0.1.4, =0.1.5 Source cves: CVE-2026-67338 Source advisory: OSV:GHSA-VMHF-C436-HXJ4...

kudaf-jupyter-server-extension (>=0.2.0, <=0.3.0), parcel-data-collector (0.1.0) +1 more potentially affected by CVE-2026-67338 via jupyterlab (3.6.5)

jupyterlab PYPI version 3.6.5 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - kudaf-jupyter-server-extension =0.2.0, =0.1.0, =1.2.0 Source cves: CVE-2026-67338 Source advisory: OSV:GHSA-VMHF-C436-HXJ4...

eflow (0.1.3) potentially affected by CVE-2026-67338 via jupyterlab (1.1.4)

jupyterlab PYPI version 1.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - eflow 0.1.3 Source cves: CVE-2026-67338 Source advisory: OSV:GHSA-VMHF-C436-HXJ4...

ai-test-designer (0.0.1), aquirdturtle-collapsible-headings (>=3.0.0, <=3.1.0) +262 more potentially affected by CVE-2026-67338 via jupyterlab (3.6.8)

jupyterlab PYPI version 3.6.8 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - ai-test-designer 0.0.1 - aquirdturtle-collapsible-headings =3.0.0, =0.1.0, =0.5.1, =1.0.0, =1.26.0, =1.0.2, =1.0.2, =1.0.1, =3.0.1, =0.1.0,...

logodetect (1.1.3), viadot2 (>=2.0.0a19, <=2.0.0a26) potentially affected by CVE-2026-67338 via jupyterlab (3.2.4)

jupyterlab PYPI version 3.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - logodetect 1.1.3 - viadot2 =2.0.0a19, =2.0.0a26 Source cves: CVE-2026-67338 Source advisory: OSV:GHSA-VMHF-C436-HXJ4...

vitamin-model-checker (>=0.2.0, <=1.5.0), vitamin-model-checker-test (>=0.8.0, <=1.0.0) potentially affected by CVE-2026-67338 via jupyterlab (3.4.7)

jupyterlab PYPI version 3.4.7 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - vitamin-model-checker =0.2.0, =0.8.0, =1.0.0 Source cves: CVE-2026-67338 Source advisory: OSV:GHSA-VMHF-C436-HXJ4...

geometron (>=0.0.1.dev7, <=0.0.3) potentially affected by CVE-2026-67338 via jupyterlab (3.2.0)

jupyterlab PYPI version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - geometron =0.0.1.dev7, =0.0.3 Source cves: CVE-2026-67338 Source advisory: OSV:GHSA-VMHF-C436-HXJ4...

dcicwrangling (>=1.0.0, <=3.2.0) potentially affected by CVE-2026-67338 via jupyterlab (3.2.8)

jupyterlab PYPI version 3.2.8 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - dcicwrangling =1.0.0, =3.2.0 Source cves: CVE-2026-67338 Source advisory: OSV:GHSA-VMHF-C436-HXJ4...

atacworks (>=0.3.0, <=0.3.2) potentially affected by CVE-2026-67338 via jupyterlab (2.1.4)

jupyterlab PYPI version 2.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - atacworks =0.3.0, =0.3.2 Source cves: CVE-2026-67338 Source advisory: OSV:GHSA-VMHF-C436-HXJ4...

discretisedfield (>=0.8.14, <=0.11.1), micromagneticdata (>=0.3.2, <=0.5.1) +5 more potentially affected by CVE-2026-67338 via jupyterlab (2.2.0)

jupyterlab PYPI version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - discretisedfield =0.8.14, =0.3.2, =0.8.22, =0.1.6, =0.8.25, =0.3.0, =0.2.0, =0.6.1 Source cves: CVE-2026-67338 Source advisory:...