gha-lab-0ba60e6456

Integration Testing This folder contains the integration tests of the extension. They are defined using Playwright test runner and Galata helper. The Playwright configuration is defined in playwright.config.js. The JupyterLab server configuration to use for the integration test is defined in...

CVE-2024-39700-PoC

CVE-2024-39700 Proof of Concept Repositories created using this template with test option include update-integration-tests.yml workflow which has an RCE vulnerability. PoC PR: https://github.com/LOURC0D3/CVE-2024-39700-PoC/pull/2 Commit Action Result:...

simo-omics (1.0.0), vdk-jupyterlab-extension (>=0.1.1148943518, <=0.1.1702830068) potentially affected by CVE-2026-73415 via jupyterlab (3.6.7)

jupyterlab PYPI version 3.6.7 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - simo-omics 1.0.0 - vdk-jupyterlab-extension =0.1.1148943518, =0.1.1702830068 Source cves: CVE-2026-73415 Source advisory: OSV:PYSEC-2026-367...

CVE-2026-67338

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...

simo-omics (1.0.0), vdk-jupyterlab-extension (>=0.1.1148943518, <=0.1.1702830068) potentially affected by CVE-2026-73415 via jupyterlab (3.6.7)

jupyterlab PYPI version 3.6.7 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - simo-omics 1.0.0 - vdk-jupyterlab-extension =0.1.1148943518, =0.1.1702830068 Source cves: CVE-2026-73415 Source advisory:...

JupyterLab: PyPI extension blocklist package-name canonicalization bypass

JupyterLab's PyPI extension manager enforces blockedextensionsuris by comparing the requested install name to blocklist entries with a custom string normalization that is weaker than PyPI package-name canonicalization. An authenticated user can request a PyPI-equivalent spelling such as...

simo-omics (1.0.0), vdk-jupyterlab-extension (>=0.1.1148943518, <=0.1.1702830068) potentially affected by CVE-2026-73626 via jupyterlab (3.6.7)

jupyterlab PYPI version 3.6.7 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - simo-omics 1.0.0 - vdk-jupyterlab-extension =0.1.1148943518, =0.1.1702830068 Source cves: CVE-2026-73626 Source advisory:...

simo-omics (1.0.0), vdk-jupyterlab-extension (>=0.1.1148943518, <=0.1.1702830068) potentially affected by CVE-2026-42557 via jupyterlab (3.6.7)

jupyterlab PYPI version 3.6.7 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - simo-omics 1.0.0 - vdk-jupyterlab-extension =0.1.1148943518, =0.1.1702830068 Source cves: CVE-2026-42557 Source advisory: OSV:PYSEC-2026-253...

simo-omics (1.0.0), vdk-jupyterlab-extension (>=0.1.1148943518, <=0.1.1702830068) potentially affected by CVE-2026-40171 via jupyterlab (3.6.7)

jupyterlab PYPI version 3.6.7 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - simo-omics 1.0.0 - vdk-jupyterlab-extension =0.1.1148943518, =0.1.1702830068 Source cves: CVE-2026-40171 Source advisory: OSV:PYSEC-2026-253...

simo-omics (1.0.0), vdk-jupyterlab-extension (>=0.1.1148943518, <=0.1.1702830068) potentially affected by CVE-2025-59842 via jupyterlab (3.6.7)

jupyterlab PYPI version 3.6.7 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - simo-omics 1.0.0 - vdk-jupyterlab-extension =0.1.1148943518, =0.1.1702830068 Source cves: CVE-2025-59842 Source advisory: OSV:PYSEC-2026-148...

simo-omics (1.0.0), vdk-jupyterlab-extension (>=0.1.1148943518, <=0.1.1702830068) potentially affected by CVE-2026-67338 via jupyterlab (3.6.7)

jupyterlab PYPI version 3.6.7 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - simo-omics 1.0.0 - vdk-jupyterlab-extension =0.1.1148943518, =0.1.1702830068 Source cves: CVE-2026-67338 Source advisory:...

Cross-site Scripting (XSS)

Overview @jupyterlab/extensionmanager is a JupyterLab - Extension Manager Affected versions of this package are vulnerable to Cross-site Scripting XSS via unsanitized handling of the homepageurl field in the extension manager. An attacker can execute arbitrary JavaScript in the context of the...

CVE-2026-42266 JupyterLab has an Extension Manager API/GUI Policy Discrepancy allowing 3rd party (malicious) extensions install via POST request.

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.0.0 to 4.5.6, the allow-list of extensions that can be installed from PyPI Extension Manager allowedextensionsuris is not correctly enforced by JupyterLab. The Py...

simo-omics (1.0.0), vdk-jupyterlab-extension (>=0.1.1148943518, <=0.1.1702830068) potentially affected by CVE-2026-42557 via jupyterlab (3.6.7)

jupyterlab PYPI version 3.6.7 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - simo-omics 1.0.0 - vdk-jupyterlab-extension =0.1.1148943518, =0.1.1702830068 Source cves: CVE-2026-42557 Source advisory:...

simo-omics (1.0.0), vdk-jupyterlab-extension (>=0.1.1148943518, <=0.1.1702830068) potentially affected by CVE-2026-40171 via jupyterlab (3.6.7)

jupyterlab PYPI version 3.6.7 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - simo-omics 1.0.0 - vdk-jupyterlab-extension =0.1.1148943518, =0.1.1702830068 Source cves: CVE-2026-40171 Source advisory:...

CVE-2024-39700

JupyterLab extension template is a copier template for JupyterLab extensions. Repositories created using this template with test option include update-integration-tests.yml workflow which has an RCE vulnerability. Extension authors hosting their code on GitHub are urged to upgrade the template to...

EUVD-2025-9739

Malicious code in bioql PyPI...

EUVD-2024-38192

Malicious code in bioql PyPI...

simo-omics (1.0.0), vdk-jupyterlab-extension (>=0.1.1148943518, <=0.1.1702830068) potentially affected by CVE-2025-59842 via jupyterlab (3.6.7)

jupyterlab PYPI version 3.6.7 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - simo-omics 1.0.0 - vdk-jupyterlab-extension =0.1.1148943518, =0.1.1702830068 Source cves: CVE-2025-59842 Source advisory:...

CVE-2025-30370

jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $. These directory names are allowed in macOS and a majority of Linux distributions. If...