JupyterLab prior to 4.5.9 contains a stored cross‑site scripting flaw in the Extension Manager. The vulnerability is caused by a failure to validate URI protocols in package metadata URLs. An attacker can publish a malicious PyPI package that includes a javascript: URL in the metadata; when a user clicks the extension name in the JupyterLab interface, the JavaScript executes in the context of the JupyterLab origin. This allows the attacker to run arbitrary code, potentially exfiltrating session data, cookies, or performing other actions that compromise confidentiality, integrity, or availability of the JupyterLab environment. The weakness maps to CWE‑84, reflecting an incorrect processing of input data.

JupyterLab instances running any version earlier than 4.5.9 are affected. The product is provided by the JupyterLab community and is commonly installed on data‑science and research servers. No specific operating system or host restrictions are mentioned.

The CVSS score for this issue is 5.1, indicating a moderate severity. The EPSS score is 0.00175 (<1%), indicating a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, suggesting that a widespread exploitation campaign has not yet been recorded. The likely attack vector requires the user to interact with the malicious extension by clicking its name after the package has been installed from PyPI, so the flaw is dependent on user action and the presence of the vulnerable component. The damage manifests as arbitrary JavaScript execution within the JupyterLab session, which is a word‑level impact but can be leveraged toward more severe compromises if coupled with other weaknesses.