Security releases: JupyterLab 4.6.4, 4.5.11 & Notebook 7.6.3

JupyterLab
1

Four vulnerabilities patched in this set of releases:

  • GHSA-6966-vjj6-99xv - 6.8 (8.1 on v4.5.0 and v4.5.1): Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard
  • GHSA-3jqq-pw4j-pqcj - 6.8: Code injection in JupyterLab via a language pack’s plural forms header
  • GHSA-3325-v43h-43rv - 5.4: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs
  • GHSA-jwrc-gm9j-263p - 4.2: Command link trust prompt in JupyterLab can trust a document other than the one clicked

Patched releases:

1 Like