@datalayer/jupyter-react (>=0.0.6, <=0.9.5), @mrawdon/jupyter-react (>=0.0.23, <=0.0.32) potentially affected by CVE-2026-42557 via @jupyterlab/rendermime-extension (>=4.0.0, <=4.1.0-beta.0)

@jupyterlab/rendermime-extension NPM version =4.0.0, =0.0.6, =0.0.23, =0.0.32 Source cves: CVE-2026-42557 Source advisory: SNYK:JS-JUPYTERLABRENDERMIMEEXTENSION-16438958...

@datalayer/jupyter-react (>=0.0.6, <=0.9.5), @jupyter-notebook/application (>=7.1.0-alpha.0, <=7.4.7) +7 more potentially affected by CVE-2026-42557 via @jupyterlab/rendermime-interfaces (>=3.1.18, <=3.12.10)

@jupyterlab/rendermime-interfaces NPM version =3.1.18, =0.0.6, =7.1.0-alpha.0, =0.1.0-alpha.23, =0.1.0-alpha.7, =0.3.0-alpha.0, =0.1.0-alpha.23, =0.0.23, =0.2.0-alpha.0, =0.1.1, =0.2.2 Source cves: CVE-2026-42557 Source advisory: SNYK:JS-JUPYTERLABRENDERMIMEINTERFACES-16438959...

Cross-site Scripting (XSS)

Overview @jupyterlab/rendermime is a JupyterLab - RenderMime Affected versions of this package are vulnerable to Cross-site Scripting XSS via the handling of data-commandlinker-command and data-commandlinker-args attributes in HTML content. An attacker can execute arbitrary commands, including co...

Cross-site Scripting (XSS)

Overview @jupyterlab/rendermime-interfaces is a JupyterLab - Interfaces for Mime Renderers Affected versions of this package are vulnerable to Cross-site Scripting XSS via the handling of data-commandlinker-command and data-commandlinker-args attributes in HTML content. An attacker can execute...

@datalayer/jupyter-react (>=0.0.6, <=0.9.5), @jupyter-notebook/application-extension (>=7.1.0-rc.1, <=7.4.7) +3 more potentially affected by CVE-2026-42557 via @jupyterlab/rendermime (>=4.0.0, <=4.4.10)

@jupyterlab/rendermime NPM version =4.0.0, =0.0.6, =7.1.0-rc.1, =0.0.23, =1.29.0, =1.31.0 Source cves: CVE-2026-42557 Source advisory: SNYK:JS-JUPYTERLABRENDERMIME-16438960...