https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 21:30:33 +0000 https://vulnerability.circl.lu/vuln/ghsa-vmhf-c436-hxj4 <p><strong>Affected:</strong> PyPI: jupyterlab</p> <p>A malicious PyPI package can place a `javascript:` URL in its `[project.urls]` metadata. JupyterLab&#39;s Extension Manager renders this as the extension&#39;s home-page link without validating the protocol, so a user who clicks the extension name executes attacker-controlled JavaScript in the JupyterLab origin.</p> <p>### Details</p> <p>One of the PyPI package&#39;s URL (jupyterlab/extensions/pypi.py) is copied straight into the `homepage_url` rendered by the frontend in packages/extensionmanager/src/widget.tsx#L77-L88.</p> <p>```python best_guess_home_url = ( homepage_url # home_page / [project.urls] Homepage or data.get(&#34;project_url&#34;) or data.get(&#34;package_url&#34;) or documentation_url # docs_url / [project.urls] Documentation or source_url # [project.urls] Source Code or bug_tracker_url # bugtrack_url / [project.urls] Bug Tracker )</p> <p># homepage_url=best_guess_home_url ```</p> <p>```tsx {entry.homepage_url ? ( &lt;a href={entry.homepage_url} target=&#34;_blank&#34; rel=&#34;noopener noreferrer&#34; ...&gt; {entry.name} &lt;/a&gt; ) : ( &lt;div&gt;{entry.name}&lt;/div&gt; )} ```</p> <p>### Impact</p> <p>An attacker needs to publish a package to PyPI (no access to the target). When the package appears in a victim&#39;s extension manager list and the victim clicks the extension name, the payload runs in the JupyterLab origin.</p> <p>Preconditions: Extension Manager enabled with the default PyPI source, the malicious package appears in the victim&#39;s list/search results.</p> <p>### Patches Patched in [4.5.9](https://github.c…</p> <p><strong>Affected:</strong> PyPI: jupyterlab</p> <p>A malicious PyPI package can place a `javascript:` URL in its `[project.urls]` metadata. JupyterLab&#39;s Extension Manager renders this as the extension&#39;s home-page link without validating the protocol, so a user who clicks the extension name executes attacker-controlled JavaScript in the JupyterLab origin.</p> <p>### Details</p> <p>One of the PyPI package&#39;s URL (jupyterlab/extensions/pypi.py) is copied straight into the `homepage_url` rendered by the frontend in packages/extensionmanager/src/widget.tsx#L77-L88.</p> <p>```python best_guess_home_url = ( homepage_url # home_page / [project.urls] Homepage or data.get(&#34;project_url&#34;) or data.get(&#34;package_url&#34;) or documentation_url # docs_url / [project.urls] Documentation or source_url # [project.urls] Source Code or bug_tracker_url # bugtrack_url / [project.urls] Bug Tracker )</p> <p># homepage_url=best_guess_home_url ```</p> <p>```tsx {entry.homepage_url ? ( &lt;a href={entry.homepage_url} target=&#34;_blank&#34; rel=&#34;noopener noreferrer&#34; ...&gt; {entry.name} &lt;/a&gt; ) : ( &lt;div&gt;{entry.name}&lt;/div&gt; )} ```</p> <p>### Impact</p> <p>An attacker needs to publish a package to PyPI (no access to the target). When the package appears in a victim&#39;s extension manager list and the victim clicks the extension name, the payload runs in the JupyterLab origin.</p> <p>Preconditions: Extension Manager enabled with the default PyPI source, the malicious package appears in the victim&#39;s list/search results.</p> <p>### Patches Patched in [4.5.9](https://github.c…</p> https://vulnerability.circl.lu/vuln/ghsa-vmhf-c436-hxj4