35 matches found
EUVD-2026-89337
JupyterLab: Cross-site scripting XSS in JupyterLab via crafted language package jupyterlab.json...
PT-2026-105812
Description A language pack ships a Plural-Forms header saying how the language counts, for example nplurals=2; plural=n != 1;. JupyterLab turns that string into a function with new Function, so the header gets executed. The check that meant to keep it safe was a regular expression. The regex was...
PT-2026-105815
Description A language pack ships a Plural-Forms header saying how the language counts, for example nplurals=2; plural=n != 1;. JupyterLab turns that string into a function with new Function, so the header gets executed. The check that meant to keep it safe was a regular expression. The regex was...
SUSE CVE-2026-102830
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 3.0.0 until 4.5.11 and 4.6.4, and in JupyterLite Core 0.8.3 and earlier, the Plural-Forms header in a selected third-party language pack can append...
Linux Distros Unpatched Vulnerability : CVE-2026-102830
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 3.0.0 until 4.5....
CVE-2026-102830
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 3.0.0 until 4.5.11 and 4.6.4, and in JupyterLite Core 0.8.3 and earlier, the Plural-Forms header in a selected third-party language pack can append...
DEBIAN-CVE-2026-102830
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 3.0.0 until 4.5.11 and 4.6.4, and in JupyterLite Core 0.8.3 and earlier, the Plural-Forms header in a selected third-party language pack can append...
UBUNTU-CVE-2026-102830
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 3.0.0 until 4.5.11 and 4.6.4, and in JupyterLite Core 0.8.3 and earlier, the Plural-Forms header in a selected third-party language pack can append...
CVE-2026-102830
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 3.0.0 until 4.5.11 and 4.6.4, and in JupyterLite Core 0.8.3 and earlier, the Plural-Forms header in a selected third-party language pack can append...
CVE-2026-102830 JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 3.0.0 until 4.5.11 and 4.6.4, and in JupyterLite Core 0.8.3 and earlier, the Plural-Forms header in a selected third-party language pack can append...
CVE-2026-102830
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 3.0.0 until 4.5.11 and 4.6.4, and in JupyterLite Core 0.8.3 and earlier, the Plural-Forms header in a selected third-party language pack can append...
CVE-2026-102830: Improper Neutralization of Input During Web Page Generation
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 3.0.0 until 4.5.11 and 4.6.4, and in JupyterLite Core 0.8.3 and earlier, the Plural-Forms header in a selected third-party language pack can append...
PT-2026-102815
Name of the Vulnerable Software and Affected Versions JupyterLab versions 3.0.0 through 4.5.10 JupyterLab versions 4.6.0 through 4.6.3 JupyterLite Core versions 0.x through 0.8.3 Description An issue exists where the Plural-Forms header in selected third-party language packs can append JavaScript...
CVE-2026-13048: Improper Neutralization of Directives in Dynamically Evaluated Code
Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because loadlexicon interpolates the language attribute into the catalog filename. loadlexicon builds the catalog path by appending Messages/$lang.po to the directory...
Typecho-GetText-eval-RCE-PoC
Typecho GetText Plural-Forms eval Remote Code Execution...
EUVD-2016-7109
Malicious code in bioql PyPI...
Linux Distros Unpatched Vulnerability : CVE-2024-43370
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gettext.js is a GNU gettext port for node and the browser. There is a cross-site scripting XSS injection if .po dictionary definition files are corrupted. This...
CVE-2024-43370
gettext.js is a GNU gettext port for node and the browser. There is a cross-site scripting XSS injection if .po dictionary definition files are corrupted. This vulnerability has been patched in version 2.0.3. As a workaround, control the origin of the definition catalog to prevent the use of this...
CVE-2024-43370: Improper Neutralization of Input During Web Page Generation
gettext.js is a GNU gettext port for node and the browser. There is a cross-site scripting XSS injection if .po dictionary definition files are corrupted. This vulnerability has been patched in version 2.0.3. As a workaround, control the origin of the definition catalog to prevent the use of this...
CVE-2024-43370 gettext.js vulnerable to cross-site scripting (XSS)
gettext.js is a GNU gettext port for node and the browser. There is a cross-site scripting XSS injection if .po dictionary definition files are corrupted. This vulnerability has been patched in version 2.0.3. As a workaround, control the origin of the definition catalog to prevent the use of this...