An update for python-jupyterlab is now available for openEuler-24.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-4168 Final 1.0 1.0 2026-09-30 Initial 2026-09-30 2026-09-30 openEuler SA Tool V1.0 2026-09-30 python-jupyterlab security update An update for python-jupyterlab is now available for openEuler-24.03-LTS-SP4 JupyterLab is the next-generation user interface for Project Jupyter offering all the familiar building blocks of the classic Jupyter Notebook (notebook, terminal, text editor, file browser, rich outputs, etc.) in a flexible and powerful user interface. Security Fix(es): JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the JupyterLab origin when users click the extension name.(CVE-2026-67338) JupyterLab versions >=4.6.0,<=4.6.1 and <=4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install(). A missing 'await' caused the is_install_allowed coroutine to never execute, so the extension allowlist/blocklist check was not enforced for direct callers of install(). The stock JupyterLab HTTP API and Extension Manager UI are not affected, as they perform a separate, correctly awaited check. The issue affects only deployments where a custom extension or downstream integration imports PyPIExtensionManager and calls install() directly with a package name influenced by untrusted input, an allowlist/blocklist is configured, the PyPI Extension Manager is enabled, and kernels and terminals are disabled or delegated to remote hosts. Fixed in JupyterLab 4.6.2 and 4.5.10.(CVE-2026-73626) An update for python-jupyterlab is now available for openEuler-24.03-LTS-SP4. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High python-jupyterlab https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4168 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-67338 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-73626 https://nvd.nist.gov/vuln/detail/CVE-2026-67338 https://nvd.nist.gov/vuln/detail/CVE-2026-73626 openEuler-24.03-LTS-SP4 python3-jupyterlab-4.3.5-5.oe2403sp4.noarch.rpm python-jupyterlab-4.3.5-5.oe2403sp4.src.rpm JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the JupyterLab origin when users click the extension name. 2026-09-30 CVE-2026-67338 openEuler-24.03-LTS-SP4 Medium 6.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N python-jupyterlab security update 2026-09-30 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4168 JupyterLab versions >=4.6.0,<=4.6.1 and <=4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install(). A missing 'await' caused the is_install_allowed coroutine to never execute, so the extension allowlist/blocklist check was not enforced for direct callers of install(). The stock JupyterLab HTTP API and Extension Manager UI are not affected, as they perform a separate, correctly awaited check. The issue affects only deployments where a custom extension or downstream integration imports PyPIExtensionManager and calls install() directly with a package name influenced by untrusted input, an allowlist/blocklist is configured, the PyPI Extension Manager is enabled, and kernels and terminals are disabled or delegated to remote hosts. Fixed in JupyterLab 4.6.2 and 4.5.10. 2026-09-30 CVE-2026-73626 openEuler-24.03-LTS-SP4 High 7.5 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H python-jupyterlab security update 2026-09-30 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4168