gha-lab-0ba60e6456

통합 테스트 이 폴더에는 확장 프로그램의 통합 테스트가 포함되어 있습니다. 테스트는 Playwright 테스트 러너와 Galata 헬퍼를 사용하여 정의됩니다. Playwright 구성은 playwright.config.js에 정의되어 있습니다. 통합 테스트에 사용할 JupyterLab 서버 구성은 jupyterservertestconfig.py에 정의되어 있습니다. 기본 구성은 실패한 테스트에 대한 비디오와 HTML 보고서를 생성합니다. 당신이 사랑에 빠질 수도 있는 새로운 실험적 UI 모드가 있습니다. 해당 비디오를 참조하세...

mcpjam-to-root

⚠️ Отказ от ответственности Этот репозиторий предназначен только для авторизованных исследований безопасности, тестирования на проникновение и образовательных целей. Не используйте описанные здесь техники против систем без явного разрешения. ⚡ MCPJam → root От RCE в MCPJam Inspector до root —...

CVE-2024-39700-PoC

CVE-2024-39700 Proof of Concept Repositories created using this template with test option include update-integration-tests.yml workflow which has an RCE vulnerability. PoC PR: https://github.com/LOURC0D3/CVE-2024-39700-PoC/pull/2 Commit Action Result:...

PT-2026-86651

Interesting GitHub Security Lab disclosure: same-second TOCTOU in jupyterlab/maintainer-tools update-snapshots-checkout CVE-2026-84973. Race between checkout and snapshot update. Window is measured in the same second the workflow runs. Classic TOCTOU, but in a maintainer tooling path that many...

Jupyterlab Python Library 4.1.x < 4.5.10 / 4.6.x < 4.6.2 (CVE-2026-73627)

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. The detected version of the JupyterLab Python package is 4.1.x prior to 4.5.10, or 4.6.x prior to 4.6.2. It is, therefore, affected by a vulnerability: - JupyterLab...

Jupyterlab Python Library < 4.5.10 / 4.6.x < 4.6.2 (CVE-2026-73626)

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. The detected version of the JupyterLab Python package is prior to 4.5.10, or 4.6.x prior to 4.6.2. It is, therefore, affected by a vulnerability: - JupyterLab contains a...

jupyter-jupyterlab-4.5.10-1.1 on GA media (moderate)

jupyter-jupyterlab-4.5.10-1.1 on GA media Announcement ID: openSUSE-SU-2026:11634-1 Rating: moderate Cross-References: CVE-2026-73415 CVE-2026-73416 CVE-2026-73417 CVE-2026-73626 CVE-2026-73627 Affected Products: openSUSE Tumbleweed An update that solves 5 vulnerabilities can now be installed...

OPENSUSE-SU-2026:11634-1 jupyter-jupyterlab-4.5.10-1.1 on GA media

These are all security issues fixed in the jupyter-jupyterlab-4.5.10-1.1 package on the GA media of openSUSE Tumbleweed...

BIT-JUPYTERLAB-2026-73417 JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 3.3.0 until 4.5.10 and 4.6.2, JupyterLab allows notebook settings to be shared and applied through an overrides.json file using the Import button in the Settings...

BIT-JUPYTERLAB-2026-73416 jupyterlab: PyPI extension blocklist package-name canonicalization bypass

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.0 until 4.5.10 and 4.6.2, in jupyterlab/extensions/manager.py and jupyterlab/extensions/pypi.py, JupyterLab's PyPI extension manager enforces...

BIT-JUPYTERLAB-2026-73415 jupyterlab: Image viewer in JupyterLab allows XSS when opening malicious image in new browser tab

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.10 and 4.6.2, in packages/imageviewer/src/widget.ts, JupyterLab's ImageViewer uses URL.createObjectURL for a specially crafted SVG image and revokes the blo...

CVE-2026-73626

A flaw was found in JupyterLab where a missing 'await' in the PyPIExtensionManager.install function could lead to an allowlist/blocklist enforcement gap. This vulnerability allows direct callers of install to bypass security checks, potentially enabling the installation of unauthorized extensions...

CVE-2026-73627

A flaw was found in JupyterLab. An authenticated user can bypass administrator lock rules in the plugin manager by making direct requests to the /lab/api/plugins endpoint. This allows them to enable or disable plugins that were locked, including child plugins and those locked via the 'lock all'...

CVE-2026-73415

A flaw was found in JupyterLab. The ImageViewer component improperly handles specially crafted SVG images by revoking a blob URL too early. This allows a remote attacker to exploit a cross-site scripting XSS vulnerability when a malicious image is opened through the image viewer and subsequently ...

CVE-2026-73416

A flaw was found in jupyterlab. The PyPI Python Package Index extension manager uses a custom normalization process for package names that is weaker than the official PyPI canonicalization. This allows an authenticated user to bypass blocklist restrictions by using an alternative spelling of a...

CVE-2026-73417

A flaw was found in JupyterLab. Improper validation of sideBySideLeftMarginOverride and sideBySideRightMarginOverride settings within the overrides.json file allows for cross-site scripting XSS. An attacker can exploit this by convincing a user to import a specially crafted settings file, or by...

Linux Distros Unpatched Vulnerability : CVE-2026-73416

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.0 until 4.5.10 and 4.6....

Linux Distros Unpatched Vulnerability : CVE-2026-73417

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 3.3.0 until 4.5.10 and 4.6....

Linux Distros Unpatched Vulnerability : CVE-2026-73415

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.10 and 4.6.2, in...

Linux Distros Unpatched Vulnerability : CVE-2026-73627

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - JupyterLab pip package 'jupyterlab' versions =4.1.0,=4.6.0,=4.6.1 contain a plugin manager lock-rule enforcement bypass. Two server-side enforcement gaps allow ...