Vulnerabilities for jupyterlite-core

First version without a known vulnerability: 0.9.0a0

Details

• GHSA-3jqq-pw4j-pqcj2026-10-01

  JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)

  Fixed in: 4.6.4, 4.5.11, 0.8.4

• GHSA-6966-vjj6-99xv2026-10-01

  JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard

  Fixed in: 4.6.4, 4.5.11, 7.6.3, 0.8.4

• GHSA-gj55-2xf9-67rq2024-09-06

  HTML injection in JupyterLite leading to DOM Clobbering

  Fixed in: 0.4.1