jupyterlab - Debian Package Tracker

general

source: jupyterlab (main)
version: 4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-3
maintainer: Debian Javascript Maintainers (archive) (DMD)
uploaders: Roland Mas [DMD] – Bastien Roucariès [DMD] – Yadd [DMD]
arch: all
std-ver: 4.7.2
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

stable: 4.0.11+ds1+~cs11.25.27-7
testing: 4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-3
unstable: 4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-3

versioned links

4.0.11+ds1+~cs11.25.27-7: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

jupyterlab (1 bugs: 0, 1, 0, 0)

action needed

Debci reports failed tests high

unstable: pass (log)
The tests ran in 0:37:08
Last run: 2026-07-20T09:48:26.000Z
Previous status: unknown

testing: fail (log)
The tests ran in 3:18:53
Last run: 2026-08-01T22:17:39.000Z
Previous status: unknown

stable: neutral (log)
The tests ran in 0:03:06
Last run: 2026-07-18T12:06:24.000Z
Previous status: unknown

Created: 2026-08-01 Last update: 2026-08-04 13:32

A new upstream version is available: 4.7.0a1+~4.1.1+~0.17.1+~cs1.4.4 high

A new upstream version 4.7.0a1+~4.1.1+~0.17.1+~cs1.4.4 is available, you should consider packaging it.

Created: 2026-07-29 Last update: 2026-08-04 12:00

10 security issues in trixie high

There are 10 open security issues in trixie.

8 important issues:

CVE-2024-56334: systeminformation is a System and OS information library for node.js. In affected versions SSIDs are not sanitized when before they are passed as a parameter to cmd.exe in the `getWindowsIEEE8021x` function. This means that malicious content in the SSID can be executed as OS commands. This vulnerability may enable an attacker, depending on how the package is used, to perform remote code execution or local privilege escalation. This issue has been addressed in version 5.23.7 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2025-68154: systeminformation is a System and OS information library for node.js. In versions prior to 5.27.14, the `fsSize()` function in systeminformation is vulnerable to OS command injection on Windows systems. The optional `drive` parameter is directly concatenated into a PowerShell command without sanitization, allowing arbitrary command execution when user-controlled input reaches this function. The actual exploitability depends on how applications use this function. If an application does not pass user-controlled input to `fsSize()`, it is not vulnerable. Version 5.27.14 contains a patch.
CVE-2026-26280: systeminformation is a System and OS information library for node.js. In versions prior to 5.30.8, a command injection vulnerability in the `wifiNetworks()` function allows an attacker to execute arbitrary OS commands via an unsanitized network interface parameter in the retry code path. In `lib/wifi.js`, the `wifiNetworks()` function sanitizes the `iface` parameter on the initial call (line 437). However, when the initial scan returns empty results, a `setTimeout` retry (lines 440-441) calls `getWifiNetworkListIw(iface)` with the **original unsanitized** `iface` value, which is passed directly to `execSync('iwlist ${iface} scan')`. Any application passing user-controlled input to `si.wifiNetworks()` is vulnerable to arbitrary command execution with the privileges of the Node.js process. Version 5.30.8 fixes the issue.
CVE-2026-26318: systeminformation is a System and OS information library for node.js. Versions prior to 5.31.0 are vulnerable to command injection via unsanitized `locate` output in `versions()`. Version 5.31.0 fixes the issue.
CVE-2026-40171: In Jupyter Notebook versions 7.0.0 through 7.5.5, JupyterLab versions 4.5.6 and earlier, and the corresponding @jupyter-notebook/help-extension and @jupyterlab/help-extension packages before 7.5.6 and 4.5.7, a stored cross-site scripting issue in the help command linker can be chained with attacker-controlled notebook content to steal authentication tokens with a single click. An attacker can craft a malicious notebook file containing elements that appear indistinguishable from legitimate controls and trigger execution when a user interacts with them. Successful exploitation allows theft of the user's authentication token and complete takeover of the Jupyter session through the REST API, including reading files, creating or modifying files, accessing kernels to execute arbitrary code, and creating terminals for shell access. This issue has been fixed in Notebook 7.5.6, JupyterLab 4.5.7, @jupyter-notebook/help-extension 7.5.6, and @jupyterlab/help-extension 4.5.7. As a workaround, disable the affected help extensions or set allowCommandLinker to false in the sanitizer configuration.
CVE-2026-42266: JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.0.0 to 4.5.6, the allow-list of extensions that can be installed from PyPI Extension Manager (allowed_extensions_uris) is not correctly enforced by JupyterLab. The PyPI Extension Manager was not contained to packages listed on the default PyPI index. This vulnerability is fixed in 4.5.7.
CVE-2026-42557: jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.7, JupyterLab's HTML sanitizer allowlists data-commandlinker-command and data-commandlinker-args on button elements, while CommandLinker listens for all click events on document.body and executes the named command without checking whether the element came from trusted JupyterLab UI. A notebook with a pre-saved HTML cell output containing a deceptive button can trigger arbitrary JupyterLab commands - including arbitrary code execution - on a single user click, without any code being submitted for execution by the user. This vulnerability is fixed in 4.5.7.
CVE-2026-67338: JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the JupyterLab origin when users click the extension name.

2 issues left for the package maintainer to handle:

CVE-2025-59842: (needs triaging) jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to version 4.4.8, links generated with LaTeX typesetters in Markdown files and Markdown cells in JupyterLab and Jupyter Notebook did not include the noopener attribute. This is deemed to have no impact on the default installations. Theoretically users of third-party LaTeX-rendering extensions could find themselves vulnerable to reverse tabnabbing attacks if links generated by those extensions included target=_blank (no such extensions are known at time of writing) and they were to click on a link generated in LaTeX (typically visibly different from other links). This issue has been patched in version 4.4.8.
CVE-2026-44724: (needs triaging) systeminformation is a System and OS information library for node.js. From 4.17.0 to 5.31.5, on Linux, systeminformation is vulnerable to command injection in networkInterfaces() when an active NetworkManager connection profile name contains shell metacharacters. The vulnerable value is obtained internally from real nmcli device status output. The library sanitizes the network interface name before using it in shell commands, but it does not apply equivalent sanitization to the parsed NetworkManager connection profile name. That unsanitized connectionName is then interpolated into three shell command strings executed through execSync(). This vulnerability is fixed in 5.31.6.

You can find information about how to handle these issues in the security team's documentation.

Created: 2025-09-27 Last update: 2026-08-02 20:32

1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:

CVE-2026-67338: JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the JupyterLab origin when users click the extension name.

Created: 2026-08-02 Last update: 2026-08-02 20:32

1 security issue in forky high

There is 1 open security issue in forky.

1 important issue:

CVE-2026-67338: JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the JupyterLab origin when users click the extension name.

Created: 2026-08-02 Last update: 2026-08-02 20:32

Does not build reproducibly during testing normal

A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!

Created: 2026-01-14 Last update: 2026-08-04 12:01

1 new commit since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 33a6517cb522a8581702cdf1b44e78f5ca717c7a
Author: Alexandre Detiste <tchet@debian.org>
Date:   Wed Jul 29 11:49:01 2026 +0200

    Salsa CI: test the nocheck profile

https://salsa.debian.org/api/v4/projects/science-team%2Fjupyterlab API request failed: 401 Unauthorized at /srv/qa.debian.org/data/vcswatch/vcswatch line 410.

Created: 2026-07-29 Last update: 2026-07-29 10:21

lintian reports 23 warnings normal

Lintian reports 23 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-07-28 Last update: 2026-07-28 20:32

AppStream hints: 1 warning for jupyterlab normal

AppStream found metadata issues for packages:

jupyterlab: 1 warning

You should get rid of them to provide more metadata about this software.

Created: 2025-06-05 Last update: 2025-06-05 23:30

debian/patches: 1 patch to forward upstream low

Among the 25 debian patches available in version 4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-3 of the package, we noticed the following issues:

1 patch where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2026-07-28 Last update: 2026-07-28 23:00

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.7.2).

Created: 2025-12-23 Last update: 2026-07-28 16:30

news

[rss feed]

[2026-07-31] jupyterlab 4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-3 MIGRATED to testing (Debian testing watch)
[2026-07-28] Accepted jupyterlab 4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-3 (source) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2026-07-28] jupyterlab 4.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-8 MIGRATED to testing (Debian testing watch)
[2026-07-24] Accepted jupyterlab 4.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-8 (source) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2026-07-22] Accepted jupyterlab 4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-2 (source) into experimental (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2026-07-22] Accepted jupyterlab 4.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-7 (source) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2026-07-21] Accepted jupyterlab 4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-1 (source) into experimental (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2026-07-20] Accepted jupyterlab 4.4.8+ds1+~3.1.0+~0.16.6+~cs1.4.4-1 (source) into experimental (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2026-07-20] Accepted jupyterlab 4.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-6 (source) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2026-07-19] Accepted jupyterlab 4.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-5 (source) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2026-07-12] Accepted jupyterlab 4.4.1+ds1+~3.0.5+~0.16.6+~cs1.4.4-1 (source) into experimental (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2026-07-09] Accepted jupyterlab 4.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-4 (source) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2026-06-26] Accepted jupyterlab 4.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-3 (source) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2026-06-24] Accepted jupyterlab 4.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-2 (source) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2026-06-20] Accepted jupyterlab 4.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-1 (source) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2026-06-16] Accepted jupyterlab 4.1.3+ds1+~2.0.1+~0.15.3+~cs1.4.4-1 (source) into experimental (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2026-06-06] jupyterlab 4.0.13+ds1+~2.0.1+~cs1.4.4-1 MIGRATED to testing (Debian testing watch)
[2026-06-01] Accepted jupyterlab 4.0.13+ds1+~2.0.1+~cs1.4.4-1 (source) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2026-05-30] jupyterlab 4.0.11+ds5+~cs11.25.27-1 MIGRATED to testing (Debian testing watch)
[2026-05-27] Accepted jupyterlab 4.0.11+ds5+~cs11.25.27-1 (source) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2026-05-26] Accepted jupyterlab 4.0.11+ds4+~cs11.25.27-4 (source) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2026-05-26] Accepted jupyterlab 4.0.11+ds4+~cs11.25.27-3 (source) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2026-05-25] Accepted jupyterlab 4.0.11+ds4+~cs11.25.27-2 (source all) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2026-05-25] Accepted jupyterlab 4.0.11+ds4+~cs11.25.27-1 (source) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2026-05-25] Accepted jupyterlab 4.0.11+ds3+~cs11.25.27-1 (source) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2026-05-22] Accepted jupyterlab 4.0.11+ds2+~cs11.25.27-3 (source) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2026-03-13] jupyterlab 4.0.11+ds2+~cs11.25.27-1 MIGRATED to testing (Debian testing watch)
[2026-03-08] Accepted jupyterlab 4.0.11+ds2+~cs11.25.27-1 (source) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2025-12-09] jupyterlab 4.0.11+ds1+~cs11.25.27-9 MIGRATED to testing (Debian testing watch)
[2025-12-03] Accepted jupyterlab 4.0.11+ds1+~cs11.25.27-9 (source) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)

bugs [bug history graph]

all: 2
RC: 0
I&N: 1
M&W: 1
F&P: 0
patch: 0

links

homepage
lintian (0, 23)
buildd: logs, reproducibility
popcon
browse source code
other distros
security tracker
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-3