JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 3.0.0 until 4.5.11 and 4.6.4, and in JupyterLite Core 0.8.3 and earlier, the Plural-Forms header in a selected third-party language pack can append JavaScript after a valid plural rule because prefix-only regular-expression validation accepts a matching prefix without requiring the entire header to match. JupyterLab passes the accepted expression to new Function, so loading the catalogue and translating a plural string executes the appended code in the authenticated JupyterLab origin. Where Jupyter Server kernels, terminals, and APIs are exposed, the code can use authenticated server APIs to read or modify files and run code. Impact is much more limited in JupyterLite because it typically lacks most exposed Jupyter Server surfaces. The default English locale is unaffected because it does not load a translation catalogue. This issue is fixed in JupyterLab 4.5.11 and 4.6.4 and JupyterLite Core 0.8.4.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter
    Notebook Architecture. From JupyterLab 3.0.0 until 4.5.11 and 4.6.4, and in JupyterLite Core 0.8.3 and
    earlier, the Plural-Forms header in a selected third-party language pack can append JavaScript after a
    valid plural rule because prefix-only regular-expression validation accepts a matching prefix without
    requiring the entire header to match. JupyterLab passes the accepted expression to new Function, so
    loading the catalogue and translating a plural string executes the appended code in the authenticated
    JupyterLab origin. Where Jupyter Server kernels, terminals, and APIs are exposed, the code can use
    authenticated server APIs to read or modify files and run code. Impact is much more limited in JupyterLite
    because it typically lacks most exposed Jupyter Server surfaces. The default English locale is unaffected
    because it does not load a translation catalogue. This issue is fixed in JupyterLab 4.5.11 and 4.6.4 and
    JupyterLite Core 0.8.4. (CVE-2026-102830)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter     Notebook Architecture. From JupyterLab 3.0.0 until 4.5.11 and 4.6.4, and in JupyterLite Core 0.8.3 and     earlier, the Plural-Forms header in a selected third-party language pack can append JavaScript after a     valid plural rule because prefix-only regular-expression validation accepts a matching prefix without     requiring the entire header to match. JupyterLab passes the accepted expression to new Function, so     loading the catalogue and translating a plural string executes the appended code in the authenticated     JupyterLab origin. Where Jupyter Server kernels, terminals, and APIs are exposed, the code can use     authenticated server APIs to read or modify files and run code. Impact is much more limited in JupyterLite     because it typically lacks most exposed Jupyter Server surfaces. The default English locale is unaffected     because it does not load a translation catalogue. This issue is fixed in JupyterLab 4.5.11 and 4.6.4 and     JupyterLite Core 0.8.4. (CVE-2026-102830)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
473746	Chainguard: jupyterhub-k8s-singleuser-sample: security update to 4.4.2-r7	Tenable Cloud Security	Chainguard Local Security Checks	Local	medium
473746	Chainguard: jupyterhub-k8s-singleuser-sample: security update to 4.4.2-r7	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	medium
351459	Linux Distros Unpatched Vulnerability : CVE-2026-102830	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-102830

medium

Tenable Plugins

medium

medium

medium