@datalayer/jupyter-react (>=0.0.6, <=0.9.5), @fails-components/jupyter-applet-view (>=0.0.1-alpha.3, <=0.0.4) +21 more potentially affected by CVE-2026-42557 via @jupyterlab/apputils (>=4.0.0, <=4.5.10)

@jupyterlab/apputils NPM version =4.0.0, =0.0.6, =0.0.1-alpha.3, =0.0.1-alpha.3, =0.0.1-alpha.3, =0.0.1-alpha.3, =7.1.0-rc.1, =7.1.0-rc.1, =7.1.0-rc.1, =7.1.0-rc.1, =7.1.0-rc.1, =7.1.0-rc.1, =0.2.0-alpha.0, =0.6.0-alpha.10, =0.6.0-alpha.10, =0.6.0-alpha.3, =0.6.0-alpha.9 and more Source cves:...

@fails-components/jupyter-applet-view (>=0.0.1-alpha.3, <=0.0.1-alpha.18), @fails-components/jupyter-filesystem-extension (>=0.0.1-alpha.3, <=0.0.1-alpha.18) +3 more potentially affected by CVE-2026-42557 via @jupyterlab/help-extension (>=4.0.13, <=4.4.10)

@jupyterlab/help-extension NPM version =4.0.13, =0.0.1-alpha.3, =0.0.1-alpha.3, =0.0.1-alpha.3, =0.0.1-alpha.3, =0.2.0-alpha.0, =0.6.0-alpha.9 Source cves: CVE-2026-42557 Source advisory: SNYK:JS-JUPYTERLABHELPEXTENSION-16438961...

HTML Injection

JupyterLite-core is vulnerable to HTML Injection. The vulnerability is due to insufficient validation of Markdown content, allowing a malicious notebook or file to access data and perform actions in the JupyterLite environment...

GHSA-GJ55-2XF9-67RQ HTML injection in JupyterLite leading to DOM Clobbering

Impact The vulnerability depends on user interaction by opening a malicious notebook with Markdown cells, or Markdown file using JupyterLab preview feature. A malicious user can access any data accessible from JupyterLite and perform arbitrary actions in JupyterLite environment. Patches JupyterLi...

PT-2024-40302 · Jupyterlab +1 · @Jupyterlab/Mathjax-Extension +3

Name of the Vulnerable Software and Affected Versions: JupyterLite versions prior to 0.4.1 Description: The issue depends on user interaction by opening a malicious notebook with Markdown cells or a Markdown file using the JupyterLab preview feature. A malicious user can access any data accessibl...