GHSA-gx64-gj6p-pc4cHigh

JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab

Published
July 22, 2026
Last Modified
August 12, 2026

🔗 CVE IDs covered (1)

CVE-2026-73415 →

📋 Description

JupyterLab's image viewer allows for cross-site scripting (XSS) when a specially-crafted image file is opened through the image viewer and then opened in a new tab. This XSS issue can be used to cause remote code execution (RCE) on the JupyterLab server.

Impact

This vulnerability allows for arbitrary code execution.

Patches

JupyterLab v4.6.2 and v4.5.10 contain the patch.

Workarounds

Disable the image viewer plugin:

jupyter labextension disable @jupyterlab/imageviewer-extension:plugin

Confirm with:

jupyter labextension list

🎯 Affected products2

  • pip/jupyterlab:>= 4.6.0, <= 4.6.1
  • pip/jupyterlab:<= 4.5.9

🔗 References (9)