CVE-2026-73415
jupyterlab: Image viewer in JupyterLab allows XSS when opening malicious image in new browser tab
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.10 and 4.6.2, in packages/imageviewer/src/widget.ts, JupyterLab's ImageViewer uses URL.createObjectURL for a specially crafted SVG image and revokes the blob URL too early, allowing the image to retain an executable same-origin context when it is opened through the image viewer and then opened in a new browser tab. The resulting cross-site scripting can be used to execute arbitrary code on the JupyterLab server. This issue is fixed in versions 4.5.10 and 4.6.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Active
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
jupyterlab: Image viewer in JupyterLab allows XSS when opening malicious image in new browser tab
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.10 and 4.6.2, in packages/imageviewer/src/widget.ts, JupyterLab's ImageViewer uses URL.createObjectURL for a specially crafted SVG image and revokes the blob URL too early, allowing the image to retain an executable same-origin context when it is opened through the image viewer and then opened in a new browser tab. The resulting cross-site scripting can be used to execute arbitrary code on the JupyterLab server. This issue is fixed in versions 4.5.10 and 4.6.2.
- Record
CVE-2026-73415- CVSS 4.0
- 7.5 High
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2026-57535
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.10 and 4.6.2, in packages/imageviewer/src/widget.ts, JupyterLab's ImageViewer uses URL.createObjectURL for a specially crafted SVG image and revokes the blob URL too early, allowing the image to retain an executable same-origin context when it is opened through the image viewer and then opened in a new browser tab. The resulting cross-site scripting can be used to execute arbitrary code on the JupyterLab server. This issue is fixed in versions 4.5.10 and 4.6.2.
- Record
EUVD-2026-57535- CVSS 4.0
- 7.5 High
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-gx64-gj6p-pc4c
JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab
JupyterLab's image viewer allows for cross-site scripting (XSS) when a specially-crafted image file is opened through the image viewer and then opened in a new tab. This XSS issue can be used to cause remote code execution (RCE) on the JupyterLab server.
Impact
This vulnerability allows for arbitrary code execution.
Patches
JupyterLab v4.6.2 and v4.5.10 contain the patch.
Workarounds
Disable the image viewer plugin:
jupyter labextension disable @jupyterlab/imageviewer-extension:plugin
Confirm with:
jupyter labextension list
- Record
GHSA-gx64-gj6p-pc4c- CVSS 4.0
- 7.5 High
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.10 and 4.6.2, in packages/imageviewer/src/widget.ts, JupyterLab's ImageViewer uses URL.createObjectURL for a specially crafted SVG image and revokes the blob URL too early, allowing the image to retain an executable same-origin context when it is opened through the image viewer and then opened in a new browser tab. The resulting cross-site scripting can be used to execute arbitrary code on the JupyterLab server. This issue is fixed in versions 4.5.10 and 4.6.2.
- Record
CVE-2026-73415- CVSS 4.0
- 7.5 High
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
jupyterlab: Image viewer in JupyterLab allows XSS when opening malicious image in new browser tab
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.10 and 4.6.2, in packages/imageviewer/src/widget.ts, JupyterLab's ImageViewer uses URL.createObjectURL for a specially crafted SVG image and revokes the blob URL too early, allowing the image to retain an executable same-origin context when it is opened through the image viewer and then opened in a new browser tab. The resulting cross-site scripting can be used to execute arbitrary code on the JupyterLab server. This issue is fixed in versions 4.5.10 and 4.6.2.
- Record
CVE-2026-73415- CVSS 4.0
- 7.5 High
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-79
- Updated
- 2026-11-07
OSVDEBIAN-CVE-2026-73415
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.10 and 4.6.2, in packages/imageviewer/src/widget.ts, JupyterLab's ImageViewer uses URL.createObjectURL for a specially crafted SVG image and revokes the blob URL too early, allowing the image to retain an executable same-origin context when it is opened through the image viewer and then opened in a new browser tab. The resulting cross-site scripting can be used to execute arbitrary code on the JupyterLab server. This issue is fixed in versions 4.5.10 and 4.6.2.
- Record
DEBIAN-CVE-2026-73415- CVSS 4.0
- 7.5 High
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
Show 5 moreShow less
OSVGHSA-gx64-gj6p-pc4c
JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab
JupyterLab's image viewer allows for cross-site scripting (XSS) when a specially-crafted image file is opened through the image viewer and then opened in a new tab. This XSS issue can be used to cause remote code execution (RCE) on the JupyterLab server.
Impact
This vulnerability allows for arbitrary code execution.
Patches
JupyterLab v4.6.2 and v4.5.10 contain the patch.
Workarounds
Disable the image viewer plugin:
jupyter labextension disable @jupyterlab/imageviewer-extension:plugin
Confirm with:
jupyter labextension list
- Record
GHSA-gx64-gj6p-pc4c- CVSS 4.0
- 7.5 High
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVPYSEC-2026-3671
JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab
JupyterLab's image viewer allows for cross-site scripting (XSS) when a specially-crafted image file is opened through the image viewer and then opened in a new tab. This XSS issue can be used to cause remote code execution (RCE) on the JupyterLab server.
Impact
This vulnerability allows for arbitrary code execution.
Patches
JupyterLab v4.6.2 and v4.5.10 contain the patch.
Workarounds
Disable the image viewer plugin:
jupyter labextension disable @jupyterlab/imageviewer-extension:plugin
Confirm with:
jupyter labextension list
- Record
PYSEC-2026-3671- CVSS 4.0
- 7.5 High
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-73415
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.10 and 4.6.2, in packages/imageviewer/src/widget.ts, JupyterLab's ImageViewer uses URL.createObjectURL for a specially crafted SVG image and revokes the blob URL too early, allowing the image to retain an executable same-origin context when it is opened through the image viewer and then opened in a new browser tab. The resulting cross-site scripting can be used to execute arbitrary code on the JupyterLab server. This issue is fixed in versions 4.5.10 and 4.6.2.
- Record
UBUNTU-CVE-2026-73415- CVSS 4.0
- 7.5 High
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N - Updated
- 2026-11-02
OSVBIT-jupyterlab-2026-73415 No score
jupyterlab: Image viewer in JupyterLab allows XSS when opening malicious image in new browser tab
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.10 and 4.6.2, in packages/imageviewer/src/widget.ts, JupyterLab's ImageViewer uses URL.createObjectURL for a specially crafted SVG image and revokes the blob URL too early, allowing the image to retain an executable same-origin context when it is opened through the image viewer and then opened in a new browser tab. The resulting cross-site scripting can be used to execute arbitrary code on the JupyterLab server. This issue is fixed in versions 4.5.10 and 4.6.2.
- Record
BIT-jupyterlab-2026-73415- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11634-1 No score
jupyter-jupyterlab-4.5.10-1.1 on GA media
These are all security issues fixed in the jupyter-jupyterlab-4.5.10-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11634-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
jupyterlabPyPI |
4.6.0 to 4.6.1 | 4.6.2 |
jupyterlabPyPI |
through 4.5.9 | 4.5.10 |
jupyterlabBitnami |
before 4.5.10, 4.6.0 up to 4.6.2 | 4.5.104.6.2 |
jupyterlabDebian:13 |
All versions, plus listed versions 4.0.11+ds1+~cs11.25.27-74.0.11+ds1+~cs11.25.27-84.0.11+ds1+~cs11.25.27-94.0.11+ds2+~cs11.25.27-14.0.11+ds2+~cs11.25.27-3 Show 24 moreShow less4.0.11+ds3+~cs11.25.27-14.0.11+ds4+~cs11.25.27-14.0.11+ds4+~cs11.25.27-24.0.11+ds4+~cs11.25.27-34.0.11+ds4+~cs11.25.27-44.0.11+ds5+~cs11.25.27-14.0.13+ds1+~2.0.1+~cs1.4.4-14.1.3+ds1+~2.0.1+~0.15.3+~cs1.4.4-14.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-14.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-24.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-34.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-44.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-54.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-64.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-74.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-84.4.1+ds1+~3.0.5+~0.16.6+~cs1.4.4-14.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-14.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-24.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-34.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-44.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-54.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-64.4.8+ds1+~3.1.0+~0.16.6+~cs1.4.4-1 |
None known |
jupyterlabDebian:14 |
before 4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-4, plus listed versions 4.0.11+ds1+~cs11.25.27-74.0.11+ds1+~cs11.25.27-84.0.11+ds1+~cs11.25.27-94.0.11+ds2+~cs11.25.27-14.0.11+ds2+~cs11.25.27-3 Show 21 moreShow less4.0.11+ds3+~cs11.25.27-14.0.11+ds4+~cs11.25.27-14.0.11+ds4+~cs11.25.27-24.0.11+ds4+~cs11.25.27-34.0.11+ds4+~cs11.25.27-44.0.11+ds5+~cs11.25.27-14.0.13+ds1+~2.0.1+~cs1.4.4-14.1.3+ds1+~2.0.1+~0.15.3+~cs1.4.4-14.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-14.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-24.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-34.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-44.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-54.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-64.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-74.1.8+ds1+~2.0.1+~0.15.3+~cs1.4.4-84.4.1+ds1+~3.0.5+~0.16.6+~cs1.4.4-14.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-14.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-24.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-34.4.8+ds1+~3.1.0+~0.16.6+~cs1.4.4-1 |
4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-4 |
jupyterlabPyPI |
4.6.0 up to 4.6.2, plus listed versions 4.6.1 |
4.6.2 |
jupyterlabPyPI |
before 4.5.10, plus listed versions 0.0.10.0.100.0.130.0.20.0.3 Show 45 moreShow less0.0.40.0.50.0.60.0.70.0.80.0.90.1.10.1.20.10.00.11.00.11.10.11.20.11.30.12.00.12.10.13.00.13.10.13.20.14.00.15.00.15.10.16.00.16.20.17.00.17.10.17.20.17.40.17.50.18.00.18.0.dev10.18.10.19.00.2.00.20.00.20.0rc10.20.10.20.20.20.30.20.40.21.00.21.0rc10.21.0rc20.21.0rc30.21.0rc40.21.0rc5 |
4.5.10 |
jupyterlabPyPI |
before 4.5.10, 4.6.0 up to 4.6.2, plus listed versions 0.0.10.0.100.0.130.0.20.0.3 Show 45 moreShow less0.0.40.0.50.0.60.0.70.0.80.0.90.1.10.1.20.10.00.11.00.11.10.11.20.11.30.12.00.12.10.13.00.13.10.13.20.14.00.15.00.15.10.16.00.16.20.17.00.17.10.17.20.17.40.17.50.18.00.18.0.dev10.18.10.19.00.2.00.20.00.20.0rc10.20.10.20.20.20.30.20.40.21.00.21.0rc10.21.0rc20.21.0rc30.21.0rc40.21.0rc5 |
4.5.104.6.2 |
jupyterlabUbuntu:26.04:LTS |
All versions, plus listed versions 4.0.11+ds1+~cs11.25.27-74.0.11+ds1+~cs11.25.27-84.0.11+ds1+~cs11.25.27-9 |
None known |
python-jupyterlabopenSUSE:Tumbleweed From an advisory covering 5 CVEs |
before 4.5.10-1.1 | 4.5.10-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-73415 is a high vulnerability (CVSS 7.5) in Jupyterlab, published July 22, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.74%, the 54th percentile. Fixed in jupyterlab 4.6.2.
References
github.com/jupyterlab/jupyterlab/security/advisories/GHSA-gx64-gj6p-pc4c
Show 17 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-73415
security-tracker.debian.org/tracker/CVE-2026-73415
pypi.org/project/jupyterlab
ubuntu.com/security/CVE-2026-73415
cve.org/CVERecord?id=CVE-2026-73415
suse.com/security/cve/CVE-2026-73415
Left out here: 1,075 versions. The JSON record has them.