CVE-2026-73415highCWE-79

CVE-2026-73415: high-severity vulnerability in jupyterlab

jupyterlab: Image viewer in JupyterLab allows XSS when opening malicious image in new browser tab

Published

Follow this CVE+ Monitor jupyterlab+ Monitor jupyterlab

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 0.7%
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.10 and 4.6.2, in packages/imageviewer/src/widget.ts, JupyterLab's ImageViewer uses URL.createObjectURL for a specially crafted SVG image and revokes the blob URL too early, allowing the image to retain an executable same-origin context when it is opened through the image viewer and then opened in a new browser tab. The resulting cross-site scripting can be used to execute arbitrary code on the JupyterLab server. This issue is fixed in versions 4.5.10 and 4.6.2.
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Affected products
jupyterlab · jupyterlab
Related CVEs — jupyterlab

In the same product, most dangerous first.

CVE-2026-42266HIGHJupyterLab has an Extension Manager API/GUI Policy Discrepancy allowing 3rd party (malicious) extensions install via POST request.EPSS 5.7%CVE-2021-32797HIGHJupyterLab: XSS due to lack of sanitization of the action attribute of an html <form>EPSS 2.7%CVE-2026-73417HIGHJupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)EPSS 0.7%CVE-2024-22421HIGHPotential authentication and CSRF tokens leak in JupyterLabEPSS 0.7%CVE-2026-73416MEDIUMjupyterlab: PyPI extension blocklist package-name canonicalization bypassEPSS 0.7%CVE-2024-22420MEDIUMStored cross site scripting in Markdown Preview in JupyterLabEPSS 0.6%