GitHub Advisoryadvisory · PyPI

GHSA-gx64-gj6p-pc4c JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab

HIGH Published 2026-07-22 Modified 2026-08-12 Official page ↗
Aliases
CVE-2026-73415
Ecosystem
PyPI
Packages
jupyterlab
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Weaknesses
CWE-79
Reviewed
2026-07-22

Affected packages

• PyPI jupyterlab: >= 4.6.0, < 4.6.2 → fixed in 4.6.2 • PyPI jupyterlab: < 4.5.10 → fixed in 4.5.10

Description

JupyterLab's image viewer allows for cross-site scripting (XSS) when a specially-crafted image file is opened through the image viewer and then opened in a new tab. This XSS issue can be used to cause remote code execution (RCE) on the JupyterLab server. Impact This vulnerability allows for arbitrary code execution. Patches JupyterLab `v4.6.2` and `v4.5.10` contain the patch. Workarounds Disable the image viewer plugin: ``` jupyter labextension disable @jupyterlab/imageviewer-extension:plugin ``` Confirm with: ``` jupyter labextension list ```

Related

Alias · CVE (1)

  • CVE-2026-73415 jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References