Most recent entries from all

BREW-jupyterlab-CVE-2026-73415 — JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab

2026-09-29T05:43:47.442954+00:00

Affected: Homebrew: jupyterlab

JupyterLab's image viewer allows for cross-site scripting (XSS) when a specially-crafted image file is opened through the image viewer and then opened in a new tab. This XSS issue can be used to cause remote code execution (RCE) on the JupyterLab server.

### Impact

This vulnerability allows for arbitrary code execution.

### Patches

JupyterLab [`v4.6.2`](https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.2) and [`v4.5.10`](https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.10) contain the patch.

### Workarounds

Disable the image viewer plugin:

``` jupyter labextension disable @jupyterlab/imageviewer-extension:plugin ```

Confirm with:

``` jupyter labextension list ```

CVE-2026-73415 — jupyterlab: Image viewer in JupyterLab allows XSS when opening malicious image in new browser tab

2026-09-29T05:43:47.443248+00:00

Affected: jupyterlab

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.10 and 4.6.2, in packages/imageviewer/src/widget.ts, JupyterLab's ImageViewer uses URL.createObjectURL for a specially crafted SVG image and revokes the blob URL too early, allowing the image to retain an executable same-origin context when it is opened through the image viewer and then opened in a new browser tab. The resulting cross-site scripting can be used to execute arbitrary code on the JupyterLab server. This issue is fixed in versions 4.5.10 and 4.6.2.

PYSEC-2026-3671 — JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab

2026-09-29T05:43:47.443403+00:00

Affected: PyPI: jupyterlab