JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 3.0.0 until 4.5.11 and 4.6.4, and in JupyterLite Core 0.8.3 and earlier, the Plural-Forms header in a selected third-party language pack can append JavaScript after a valid plural rule because prefix-only regular-expression validation accepts a matching prefix without requiring the entire header to match. JupyterLab passes the accepted expression to new Function, so loading the catalogue and translating a plural string executes the appended code in the authenticated JupyterLab origin. Where Jupyter Server kernels, terminals, and APIs are exposed, the code can use authenticated server APIs to read or modify files and run code. Impact is much more limited in JupyterLite because it typically lacks most exposed Jupyter Server surfaces. The default English locale is unaffected because it does not load a translation catalogue. This issue is fixed in JupyterLab 4.5.11 and 4.6.4 and JupyterLite Core 0.8.4.

Affected: PyPI: jupyterlab, PyPI: jupyterlite-core

## Description

A language pack ships a `Plural-Forms` header saying how the language counts, for example `nplurals=2; plural=(n != 1);`. JupyterLab turns that string into a function with `new Function`, so the header gets executed. The check that meant to keep it safe was a regular expression. The regex was anchored at the start but not at the end, so it accepted any string that began with a valid plural rule and ignored everything after it.

A header such as the following passed the check, and the part after the plural rule ran in the JupyterLab page as soon as the first plural string was translated:

``` nplurals=2; plural=(n > 1); <anything here ran as JavaScript> ```

Users are affected if all of the following are true:

- they run JupyterLab 3.0.0 through 4.6.3, or an application that bundles it such as Notebook 7; - a language pack they did not write is installed in the environment; and - that language is selected, so its catalogue is loaded

An installation using the default English locale loads no catalogue and is not affected.

> CVE assignment pending, GitHub CNA is experiencing severe backlog

### Impact

The code in the header ran in the JupyterLab page, in the same origin and session as the authenticated user. It could call the Jupyter Server REST API as that user: read and write any file under the server root, start a kernel and run code in it, and open a terminal where terminals are enabled. Nothing had to be clicked; translating one plural string was enough,…

Affected: PyPI: jupyterlab

## Description

A language pack ships a `Plural-Forms` header saying how the language counts, for example `nplurals=2; plural=(n != 1);`. JupyterLab turns that string into a function with `new Function`, so the header gets executed. The check that meant to keep it safe was a regular expression. The regex was anchored at the start but not at the end, so it accepted any string that began with a valid plural rule and ignored everything after it.

A header such as the following passed the check, and the part after the plural rule ran in the JupyterLab page as soon as the first plural string was translated:

``` nplurals=2; plural=(n > 1); <anything here ran as JavaScript> ```

Users are affected if all of the following are true:

- they run JupyterLab 3.0.0 through 4.6.3, or an application that bundles it such as Notebook 7; - a language pack they did not write is installed in the environment; and - that language is selected, so its catalogue is loaded

An installation using the default English locale loads no catalogue and is not affected.

> CVE assignment pending, GitHub CNA is experiencing severe backlog

### Impact

The code in the header ran in the JupyterLab page, in the same origin and session as the authenticated user. It could call the Jupyter Server REST API as that user: read and write any file under the server root, start a kernel and run code in it, and open a terminal where terminals are enabled. Nothing had to be clicked; translating one plural string was enough,…

Affected: Ubuntu:26.04:LTS: jupyterlab

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 3.0.0 until 4.5.11 and 4.6.4, and in JupyterLite Core 0.8.3 and earlier, the Plural-Forms header in a selected third-party language pack can append JavaScript after a valid plural rule because prefix-only regular-expression validation accepts a matching prefix without requiring the entire header to match. JupyterLab passes the accepted expression to new Function, so loading the catalogue and translating a plural string executes the appended code in the authenticated JupyterLab origin. Where Jupyter Server kernels, terminals, and APIs are exposed, the code can use authenticated server APIs to read or modify files and run code. Impact is much more limited in JupyterLite because it typically lacks most exposed Jupyter Server surfaces. The default English locale is unaffected because it does not load a translation catalogue. This issue is fixed in JupyterLab 4.5.11 and 4.6.4 and JupyterLite Core 0.8.4.