AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

JupyterGHSA-gx64-gj6p-pc4c

JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab

Jupyter

CVE-2026-73415 · Published Jul 22, 2026 · updated Sep 10, 2026

High
Fix: upgrade to 4.5.10 or later (2 fixed versions below)
GitHub advisory

JupyterLab's image viewer allows for cross-site scripting (XSS) when a specially-crafted image file is opened through the image viewer and then opened in a new tab. This XSS issue can be used to cause remote code execution (RCE) on the JupyterLab server.

Impact

This vulnerability allows for arbitrary code execution.

Patches

JupyterLab [v4.6.2](https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.2) and [v4.5.10](https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.10) contain the patch.

Workarounds

Disable the image viewer plugin:

`

jupyter labextension disable @jupyterlab/imageviewer-extension:plugin

`

Confirm with:

`

jupyter labextension list

`

Affected versions

PackageAffectedFixed in
jupyterlab
PyPI
>= 4.6.0, < 4.6.24.6.2
< 4.5.104.5.10
Details and references
CVSS 4.0
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-79
Also known as
BIT-jupyterlab-2026-73415, CVE-2026-73415, PYSEC-2026-3671

More Jupyter advisories

All Jupyter
Medium 6.1Jul 23Jupyter: code executionCVE-2026-6657no fix yetHighJul 22JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)CVE-2026-73417fixed in 4.5.10 +1MediumJul 22JupyterLab: PyPI extension blocklist package-name canonicalization bypassCVE-2026-73416fixed in 4.5.10 +1MediumJul 22JupyterLab PluginManager lock-rule enforcement bypassCVE-2026-73627fixed in 4.5.10 +1Low 0.0Jul 22Jupyter: improper access controlCVE-2026-73626fixed in 4.5.10 +1Medium 6.8Jul 13Jupyter Server vulnerable to Path Traversal via incorrect root directory boundary check in _get_os_path()CVE-2026-5422fixed in 2.18.2