[From nobody Sun Aug 16 12:57:08 2026 Received: (at submit) by bugs.debian.org; 14 Aug 2026 06:57:12 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-9.9 required=4.0 tests=BAYES_00, FOURLA, FROMDEVELOPER, NO_RELAYS,XMAILER_REPORTBUG autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 46; hammy, 150; neutral, 172; spammy, 0. spammytokens: hammytokens:0.000-+--XDebbugsCc, 0.000-+--X-Debbugs-Cc, 0.000-+--H*F:U*carnil, 0.000-+--H*Ad:N*Bug, 0.000-+--HTo:N*Debian Return-path: <carnil@debian.org> Received: via submission by buxtehude.debian.org with esmtp (Exim 4.96) (envelope-from <carnil@debian.org>) id 1wulqp-0027k5-2O for submit@bugs.debian.org; Fri, 14 Aug 2026 06:57:11 +0000 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Salvatore Bonaccorso <carnil@debian.org> To: Debian Bug Tracking System <submit@bugs.debian.org> Subject: jupyterlab: CVE-2026-73627 CVE-2026-73626 CVE-2026-73415 CVE-2026-67338 Message-ID: <178669062757.1039596.16942390739780373938.reportbug@eldamar.lan> X-Mailer: reportbug 13.2.0+nmu1 Date: Fri, 14 Aug 2026 08:57:07 +0200 Delivered-To: submit@bugs.debian.org X-CrossAssassin-Score: 2 U291cmNlOiBqdXB5dGVybGFiClZlcnNpb246IDQuNC4xMCtkczErfjMuMS4wK34wLjE2LjYrfmNz MS40LjQtMwpTZXZlcml0eTogaW1wb3J0YW50ClRhZ3M6IHNlY3VyaXR5IHVwc3RyZWFtClgtRGVi YnVncy1DYzogY2FybmlsQGRlYmlhbi5vcmcsIERlYmlhbiBTZWN1cml0eSBUZWFtIDx0ZWFtQHNl Y3VyaXR5LmRlYmlhbi5vcmc+CgpIaSwKClRoZSBmb2xsb3dpbmcgdnVsbmVyYWJpbGl0aWVzIHdl cmUgcHVibGlzaGVkIGZvciBqdXB5dGVybGFiLgoKQ2FuIHlvdSAgaGVscCBwcm9wZXJseSBhc3Nl cyBpc29sYXRpbmcgdGhlIGZpeGluZyBjb21taXRzIG5lZWRlZC4KCkNWRS0yMDI2LTczNjI3WzBd Ogp8IEp1cHl0ZXJMYWIgKHBpcCBwYWNrYWdlICdqdXB5dGVybGFiJykgdmVyc2lvbnMgPj00LjEu MCw8PTQuNS45IGFuZAp8ID49NC42LjAsPD00LjYuMSBjb250YWluIGEgcGx1Z2luIG1hbmFnZXIg bG9jay1ydWxlIGVuZm9yY2VtZW50CnwgYnlwYXNzLiBUd28gc2VydmVyLXNpZGUgZW5mb3JjZW1l bnQgZ2FwcyBhbGxvdyBhbiBhdXRoZW50aWNhdGVkIHVzZXIKfCB0byBjaXJjdW12ZW50IGFkbWlu aXN0cmF0b3IgbG9jayBydWxlcyBieSBtYWtpbmcgZGlyZWN0IHJlcXVlc3RzIHRvCnwgdGhlIC9s YWIvYXBpL3BsdWdpbnMgZW5kcG9pbnQsIGVuYWJsaW5nIG9yIGRpc2FibGluZyBwbHVnaW5zIHRo YXQKfCB3ZXJlIGxvY2tlZCDigJQgaW5jbHVkaW5nIGNoaWxkIHBsdWdpbnMgb2YgbXVsdGktcGx1 Z2luIGV4dGVuc2lvbnMgYW5kCnwgcGx1Z2lucyBsb2NrZWQgdmlhIHRoZSAnbG9jayBhbGwnIG1l Y2hhbmlzbS4gVGhpcyBjYW4gaW1wYWN0IGRhdGEKfCBpbnRlZ3JpdHkgYW5kIGJ5cGFzcyBoYXJk ZW5pbmcgb3IgcmVzdHJpY3Rpb25zIChlLmcuLAp8IGRvd25sb2FkL3VwbG9hZCBsaW1pdHMpIGlt cGxlbWVudGVkIHRocm91Z2ggbG9ja2VkIHBsdWdpbnMuIEZpeGVkIGluCnwgdmVyc2lvbnMgNC42 LjIgYW5kIDQuNS4xMC4KCgpDVkUtMjAyNi03MzYyNlsxXToKfCBKdXB5dGVyTGFiIHZlcnNpb25z ID49NC42LjAsPD00LjYuMSBhbmQgPD00LjUuOSBjb250YWluIGFuCnwgYWxsb3dsaXN0L2Jsb2Nr bGlzdCBlbmZvcmNlbWVudCBnYXAgaW4KfCBQeVBJRXh0ZW5zaW9uTWFuYWdlci5pbnN0YWxsKCku IEEgbWlzc2luZyAnYXdhaXQnIGNhdXNlZCB0aGUKfCBpc19pbnN0YWxsX2FsbG93ZWQgY29yb3V0 aW5lIHRvIG5ldmVyIGV4ZWN1dGUsIHNvIHRoZSBleHRlbnNpb24KfCBhbGxvd2xpc3QvYmxvY2ts aXN0IGNoZWNrIHdhcyBub3QgZW5mb3JjZWQgZm9yIGRpcmVjdCBjYWxsZXJzIG9mCnwgaW5zdGFs bCgpLiBUaGUgc3RvY2sgSnVweXRlckxhYiBIVFRQIEFQSSBhbmQgRXh0ZW5zaW9uIE1hbmFnZXIg VUkKfCBhcmUgbm90IGFmZmVjdGVkLCBhcyB0aGV5IHBlcmZvcm0gYSBzZXBhcmF0ZSwgY29ycmVj dGx5IGF3YWl0ZWQKfCBjaGVjay4gVGhlIGlzc3VlIGFmZmVjdHMgb25seSBkZXBsb3ltZW50cyB3 aGVyZSBhIGN1c3RvbSBleHRlbnNpb24KfCBvciBkb3duc3RyZWFtIGludGVncmF0aW9uIGltcG9y dHMgUHlQSUV4dGVuc2lvbk1hbmFnZXIgYW5kIGNhbGxzCnwgaW5zdGFsbCgpIGRpcmVjdGx5IHdp dGggYSBwYWNrYWdlIG5hbWUgaW5mbHVlbmNlZCBieSB1bnRydXN0ZWQKfCBpbnB1dCwgYW4gYWxs b3dsaXN0L2Jsb2NrbGlzdCBpcyBjb25maWd1cmVkLCB0aGUgUHlQSSBFeHRlbnNpb24KfCBNYW5h Z2VyIGlzIGVuYWJsZWQsIGFuZCBrZXJuZWxzIGFuZCB0ZXJtaW5hbHMgYXJlIGRpc2FibGVkIG9y CnwgZGVsZWdhdGVkIHRvIHJlbW90ZSBob3N0cy4gRml4ZWQgaW4gSnVweXRlckxhYiA0LjYuMiBh bmQgNC41LjEwLgoKCkNWRS0yMDI2LTczNDE1WzJdOgp8IGp1cHl0ZXJsYWIgaXMgYW4gZXh0ZW5z aWJsZSBlbnZpcm9ubWVudCBmb3IgaW50ZXJhY3RpdmUgYW5kCnwgcmVwcm9kdWNpYmxlIGNvbXB1 dGluZywgYmFzZWQgb24gdGhlIEp1cHl0ZXIgTm90ZWJvb2sgQXJjaGl0ZWN0dXJlLgp8IFByaW9y IHRvIDQuNS4xMCBhbmQgNC42LjIsIGluIHBhY2thZ2VzL2ltYWdldmlld2VyL3NyYy93aWRnZXQu dHMsCnwgSnVweXRlckxhYidzIEltYWdlVmlld2VyIHVzZXMgVVJMLmNyZWF0ZU9iamVjdFVSTCBm b3IgYSBzcGVjaWFsbHkKfCBjcmFmdGVkIFNWRyBpbWFnZSBhbmQgcmV2b2tlcyB0aGUgYmxvYiBV UkwgdG9vIGVhcmx5LCBhbGxvd2luZyB0aGUKfCBpbWFnZSB0byByZXRhaW4gYW4gZXhlY3V0YWJs ZSBzYW1lLW9yaWdpbiBjb250ZXh0IHdoZW4gaXQgaXMgb3BlbmVkCnwgdGhyb3VnaCB0aGUgaW1h Z2Ugdmlld2VyIGFuZCB0aGVuIG9wZW5lZCBpbiBhIG5ldyBicm93c2VyIHRhYi4gVGhlCnwgcmVz dWx0aW5nIGNyb3NzLXNpdGUgc2NyaXB0aW5nIGNhbiBiZSB1c2VkIHRvIGV4ZWN1dGUgYXJiaXRy YXJ5IGNvZGUKfCBvbiB0aGUgSnVweXRlckxhYiBzZXJ2ZXIuIFRoaXMgaXNzdWUgaXMgZml4ZWQg aW4gdmVyc2lvbnMgNC41LjEwIGFuZAp8IDQuNi4yLgoKCkNWRS0yMDI2LTY3MzM4WzNdOgp8IEp1 cHl0ZXJMYWIgYmVmb3JlIDQuNS45IGNvbnRhaW5zIGEgc3RvcmVkIGNyb3NzLXNpdGUgc2NyaXB0 aW5nCnwgdnVsbmVyYWJpbGl0eSBpbiB0aGUgRXh0ZW5zaW9uIE1hbmFnZXIgdGhhdCBmYWlscyB0 byB2YWxpZGF0ZSBVUkkKfCBwcm90b2NvbHMgaW4gcGFja2FnZSBtZXRhZGF0YSBVUkxzLiBBdHRh Y2tlcnMgY2FuIHB1Ymxpc2ggbWFsaWNpb3VzCnwgUHlQSSBwYWNrYWdlcyB3aXRoIGphdmFzY3Jp cHQ6IFVSTHMgaW4gcHJvamVjdCBtZXRhZGF0YSB0aGF0IGV4ZWN1dGUKfCBhcmJpdHJhcnkgSmF2 YVNjcmlwdCBpbiB0aGUgSnVweXRlckxhYiBvcmlnaW4gd2hlbiB1c2VycyBjbGljayB0aGUKfCBl eHRlbnNpb24gbmFtZS4KCgpJZiB5b3UgZml4IHRoZSB2dWxuZXJhYmlsaXRpZXMgcGxlYXNlIGFs c28gbWFrZSBzdXJlIHRvIGluY2x1ZGUgdGhlCkNWRSAoQ29tbW9uIFZ1bG5lcmFiaWxpdGllcyAm IEV4cG9zdXJlcykgaWRzIGluIHlvdXIgY2hhbmdlbG9nIGVudHJ5LgoKRm9yIGZ1cnRoZXIgaW5m b3JtYXRpb24gc2VlOgoKWzBdIGh0dHBzOi8vc2VjdXJpdHktdHJhY2tlci5kZWJpYW4ub3JnL3Ry YWNrZXIvQ1ZFLTIwMjYtNzM2MjcKICAgIGh0dHBzOi8vd3d3LmN2ZS5vcmcvQ1ZFUmVjb3JkP2lk PUNWRS0yMDI2LTczNjI3ClsxXSBodHRwczovL3NlY3VyaXR5LXRyYWNrZXIuZGViaWFuLm9yZy90 cmFja2VyL0NWRS0yMDI2LTczNjI2CiAgICBodHRwczovL3d3dy5jdmUub3JnL0NWRVJlY29yZD9p ZD1DVkUtMjAyNi03MzYyNgpbMl0gaHR0cHM6Ly9zZWN1cml0eS10cmFja2VyLmRlYmlhbi5vcmcv dHJhY2tlci9DVkUtMjAyNi03MzQxNQogICAgaHR0cHM6Ly93d3cuY3ZlLm9yZy9DVkVSZWNvcmQ/ aWQ9Q1ZFLTIwMjYtNzM0MTUKWzNdIGh0dHBzOi8vc2VjdXJpdHktdHJhY2tlci5kZWJpYW4ub3Jn L3RyYWNrZXIvQ1ZFLTIwMjYtNjczMzgKICAgIGh0dHBzOi8vd3d3LmN2ZS5vcmcvQ1ZFUmVjb3Jk P2lkPUNWRS0yMDI2LTY3MzM4CgpSZWdhcmRzLApTYWx2YXRvcmUK ]