CVE-2026-67338

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...

EUVD-2026-51849

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...

CVE-2026-67338

CVE-2026-67338 affects JupyterLab prior to 4.5.9. A stored cross-site scripting vulnerability resides in the Extension Manager where URI protocols in package metadata URLs are not validated. This allows an attacker to publish malicious PyPI packages with javascript: URLs in project metadata, enab...

ROOT-APP-PYPI-CVE-2023-44271 CVE-2023-44271 in rootio-pillow - Patched by Root

Root has patched CVE-2023-44271 in the rootio-pillow package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-34993 CVE-2026-34993 in rootio-aiohttp - Patched by Root

Root has patched CVE-2026-34993 in the rootio-aiohttp package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-GHSA-GR75-JV2W-4656 GHSA-gr75-jv2w-4656 in rootio-langchain - Patched by Root

Root has patched GHSA-gr75-jv2w-4656 in the rootio-langchain package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2023-49082 CVE-2023-49082 in rootio-aiohttp - Patched by Root

Root has patched CVE-2023-49082 in the rootio-aiohttp package for Root:PyPI. Multiple fixed versions available...

Malicious code in intel-cicd-repo-infrastructure (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 26e9f9760ea5108609a4a105c621c9ed1ac03930e70fe4cfe400f7c256a7641a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

ROOT-APP-PYPI-CVE-2026-28684 CVE-2026-28684 in rootio-python-dotenv - Patched by Root

Root has patched CVE-2026-28684 in the rootio-python-dotenv package for Root:PyPI. Multiple fixed versions available...

GHSA-89VP-JRXV-24W8 JupyterLab: PyPI extension blocklist package-name canonicalization bypass

JupyterLab's PyPI extension manager enforces blockedextensionsuris by comparing the requested install name to blocklist entries with a custom string normalization that is weaker than PyPI package-name canonicalization. An authenticated user can request a PyPI-equivalent spelling such as...

ROOT-APP-PYPI-CVE-2025-27516 CVE-2025-27516 in rootio-Jinja2 - Patched by Root

Root has patched CVE-2025-27516 in the rootio-Jinja2 package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2024-34064 CVE-2024-34064 in rootio-Jinja2 - Patched by Root

Root has patched CVE-2024-34064 in the rootio-Jinja2 package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2024-56201 CVE-2024-56201 in rootio-Jinja2 - Patched by Root

Root has patched CVE-2024-56201 in the rootio-Jinja2 package for Root:PyPI. Multiple fixed versions available...

MAL-2026-10978 Malicious code in reimagined-broccoli (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f49aaf5b1b6388b52d7afd99359db7630e272770abd123c0cfc9977c0467b78d In this campaign, packages use names similar to popular services e.g. Kimi AI to deploy cryptominer. --- Category: MALICIOUS - The campaign has clearly malicio...

MAL-2026-10929 Malicious code in trongrider (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0d44486dc374cb50abaad84a7086859ce3c2a7e5b17a790aae5b426c4cf2a1e0 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...

MAL-2026-10918 Malicious code in automatic-octo-invention (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9601d13b646d0f31e4053a8f1d2b159cba6c30b1860a67da0baa3d7d7086d9c4 In this campaign, packages use names similar to popular services e.g. Kimi AI to deploy cryptominer. --- Category: MALICIOUS - The campaign has clearly malicio...

MAL-2026-10912 Malicious code in shark-e2e-bnsneo (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-10911 Malicious code in mysuperlicense (PyPI)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in vantrala (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e598f1a12fbd4aed3a98f1942d98fb5ca47182206f0090ac57d7927010061b37 In this campaign, packages use names similar to popular services e.g. Kimi AI to deploy cryptominer. --- Category: MALICIOUS - The campaign has clearly malicio...

MAL-2026-10867 Malicious code in vantrala (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e598f1a12fbd4aed3a98f1942d98fb5ca47182206f0090ac57d7927010061b37 In this campaign, packages use names similar to popular services e.g. Kimi AI to deploy cryptominer. --- Category: MALICIOUS - The campaign has clearly malicio...