JupyterLab v4.5.7 and Notebook v7.5.6 are out on PyPI and conda-forge, including three security fixes:
- CVE-2026-42266 GHSA-37w4-hwhx-4rc4 Allowlist for PyPI Extension Manager not correctly enforced, PyPI Extension Manager not limited to default PyPI index
- CVE-2026-42557 GHSA-mqcg-5x36-vfcg Command linker attributes in HTML enable one-click command execution from untrusted content
- CVE-2026-40171 GHSA-rch3-82jr-f9w9 Command linker attributes chained with help command enable one-click authentication token theft