Vulnerability-Lookup

CVE-2026-73415 (GCVE-0-2026-73415)

Vulnerability from cvelistv5 – Published: 2026-08-12 19:54 – Updated: 2026-08-12 20:54

Title

jupyterlab: Image viewer in JupyterLab allows XSS when opening malicious image in new browser tab

Summary

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.10 and 4.6.2, in packages/imageviewer/src/widget.ts, JupyterLab's ImageViewer uses URL.createObjectURL for a specially crafted SVG image and revokes the blob URL too early, allowing the image to retain an executable same-origin context when it is opened through the image viewer and then opened in a new browser tab. The resulting cross-site scripting can be used to execute arbitrary code on the JupyterLab server. This issue is fixed in versions 4.5.10 and 4.6.2.

Severity

7.5 (High)


                        
                          CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-12 20:35 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7631 records in the last 180 days details

References

10 references

URL	Tags
https://github.com/jupyterlab/jupyterlab/security…	x_refsource_CONFIRM
https://github.com/jupyterlab/jupyterlab/pull/19184	x_refsource_MISC
https://github.com/jupyterlab/jupyterlab/pull/19185	x_refsource_MISC
https://github.com/jupyterlab/jupyterlab/pull/19186	x_refsource_MISC
https://github.com/jupyterlab/jupyterlab/commit/9…	x_refsource_MISC
https://github.com/jupyterlab/jupyterlab/commit/b…	x_refsource_MISC
https://github.com/jupyterlab/jupyterlab/commit/f…	x_refsource_MISC
https://github.com/jupyterlab/jupyterlab/releases…	x_refsource_MISC
https://github.com/jupyterlab/jupyterlab/releases…	x_refsource_MISC
https://github.com/jupyterlab/jupyterlab/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
jupyterlab	jupyterlab	Affected: < 4.5.10 Affected: >= 4.6.0, < 4.6.2	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73415",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-12T20:35:03.166189Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-12T20:54:14.775Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "jupyterlab",
          "vendor": "jupyterlab",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.5.10"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.6.0, \u003c 4.6.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.10 and 4.6.2, in packages/imageviewer/src/widget.ts, JupyterLab\u0027s ImageViewer uses URL.createObjectURL for a specially crafted SVG image and revokes the blob URL too early, allowing the image to retain an executable same-origin context when it is opened through the image viewer and then opened in a new browser tab. The resulting cross-site scripting can be used to execute arbitrary code on the JupyterLab server. This issue is fixed in versions 4.5.10 and 4.6.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T19:54:00.581Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-gx64-gj6p-pc4c",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-gx64-gj6p-pc4c"
        },
        {
          "name": "https://github.com/jupyterlab/jupyterlab/pull/19184",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jupyterlab/jupyterlab/pull/19184"
        },
        {
          "name": "https://github.com/jupyterlab/jupyterlab/pull/19185",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jupyterlab/jupyterlab/pull/19185"
        },
        {
          "name": "https://github.com/jupyterlab/jupyterlab/pull/19186",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jupyterlab/jupyterlab/pull/19186"
        },
        {
          "name": "https://github.com/jupyterlab/jupyterlab/commit/9365f020baec5221deaf11535ed554c06637c999",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jupyterlab/jupyterlab/commit/9365f020baec5221deaf11535ed554c06637c999"
        },
        {
          "name": "https://github.com/jupyterlab/jupyterlab/commit/be9303f5bcd5308eaeae953c5a3c903046682c2c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jupyterlab/jupyterlab/commit/be9303f5bcd5308eaeae953c5a3c903046682c2c"
        },
        {
          "name": "https://github.com/jupyterlab/jupyterlab/commit/f1beab4a2027af4719d6edc07d52d6cf5a39a432",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jupyterlab/jupyterlab/commit/f1beab4a2027af4719d6edc07d52d6cf5a39a432"
        },
        {
          "name": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.10",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.10"
        },
        {
          "name": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.2"
        },
        {
          "name": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.7.0a1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.7.0a1"
        }
      ],
      "source": {
        "advisory": "GHSA-gx64-gj6p-pc4c",
        "discovery": "UNKNOWN"
      },
      "title": "jupyterlab: Image viewer in JupyterLab allows XSS when opening malicious image in new browser tab"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73415",
    "datePublished": "2026-08-12T19:54:00.581Z",
    "dateReserved": "2026-08-12T14:32:11.795Z",
    "dateUpdated": "2026-08-12T20:54:14.775Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-73415",
      "date": "2026-10-19",
      "epss": "0.00737",
      "percentile": "0.53675"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "jupyterlab",
                "vendor": "jupyterlab",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 4.5.10"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 4.6.0, \u003c 4.6.2"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.10 and 4.6.2, in packages/imageviewer/src/widget.ts, JupyterLab\u0027s ImageViewer uses URL.createObjectURL for a specially crafted SVG image and revokes the blob URL too early, allowing the image to retain an executable same-origin context when it is opened through the image viewer and then opened in a new browser tab. The resulting cross-site scripting can be used to execute arbitrary code on the JupyterLab server. This issue is fixed in versions 4.5.10 and 4.6.2."
          }
        ],
        "id": "CVE-2026-73415",
        "lastModified": "2026-09-09T20:58:37.713",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "HIGH",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "ACTIVE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "LOW",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-73415",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-12T20:35:03.166189Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-08-12T20:17:56.660",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/jupyterlab/jupyterlab/commit/9365f020baec5221deaf11535ed554c06637c999"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/jupyterlab/jupyterlab/commit/be9303f5bcd5308eaeae953c5a3c903046682c2c"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/jupyterlab/jupyterlab/commit/f1beab4a2027af4719d6edc07d52d6cf5a39a432"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/jupyterlab/jupyterlab/pull/19184"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/jupyterlab/jupyterlab/pull/19185"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/jupyterlab/jupyterlab/pull/19186"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.10"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.2"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.7.0a1"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-gx64-gj6p-pc4c"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-79"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-10-19T11:26:35+00:00",
      "cve": "CVE-2026-73415",
      "id": "CVE-2026-73415",
      "initial_release_date": "2026-08-12T19:54:00.581000+00:00",
      "product_status:fixed": "76",
      "product_status:known_affected": "5",
      "product_status:known_not_affected": "691",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "jupyterlab: JupyterLab: Arbitrary code execution via malicious image in image viewer",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-73415.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-73415",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-12T20:35:03.166189Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-12T20:35:39.545Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "jupyterlab",
              "vendor": "jupyterlab",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 4.5.10"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 4.6.0, \u003c 4.6.2"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.10 and 4.6.2, in packages/imageviewer/src/widget.ts, JupyterLab\u0027s ImageViewer uses URL.createObjectURL for a specially crafted SVG image and revokes the blob URL too early, allowing the image to retain an executable same-origin context when it is opened through the image viewer and then opened in a new browser tab. The resulting cross-site scripting can be used to execute arbitrary code on the JupyterLab server. This issue is fixed in versions 4.5.10 and 4.6.2."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "HIGH",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "privilegesRequired": "NONE",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "ACTIVE",
                "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "LOW",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-79",
                  "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-12T19:54:00.581Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-gx64-gj6p-pc4c",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-gx64-gj6p-pc4c"
            },
            {
              "name": "https://github.com/jupyterlab/jupyterlab/pull/19184",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/jupyterlab/jupyterlab/pull/19184"
            },
            {
              "name": "https://github.com/jupyterlab/jupyterlab/pull/19185",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/jupyterlab/jupyterlab/pull/19185"
            },
            {
              "name": "https://github.com/jupyterlab/jupyterlab/pull/19186",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/jupyterlab/jupyterlab/pull/19186"
            },
            {
              "name": "https://github.com/jupyterlab/jupyterlab/commit/9365f020baec5221deaf11535ed554c06637c999",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/jupyterlab/jupyterlab/commit/9365f020baec5221deaf11535ed554c06637c999"
            },
            {
              "name": "https://github.com/jupyterlab/jupyterlab/commit/be9303f5bcd5308eaeae953c5a3c903046682c2c",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/jupyterlab/jupyterlab/commit/be9303f5bcd5308eaeae953c5a3c903046682c2c"
            },
            {
              "name": "https://github.com/jupyterlab/jupyterlab/commit/f1beab4a2027af4719d6edc07d52d6cf5a39a432",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/jupyterlab/jupyterlab/commit/f1beab4a2027af4719d6edc07d52d6cf5a39a432"
            },
            {
              "name": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.10",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.10"
            },
            {
              "name": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.2",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.2"
            },
            {
              "name": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.7.0a1",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.7.0a1"
            }
          ],
          "source": {
            "advisory": "GHSA-gx64-gj6p-pc4c",
            "discovery": "UNKNOWN"
          },
          "title": "jupyterlab: Image viewer in JupyterLab allows XSS when opening malicious image in new browser tab"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-73415",
        "datePublished": "2026-08-12T19:54:00.581Z",
        "dateReserved": "2026-08-12T14:32:11.795Z",
        "dateUpdated": "2026-08-12T20:54:14.775Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

bit-jupyterlab-2026-73415

Vulnerability from bitnami_vulndb

Published

2026-08-18 10:05

Modified

2026-08-18 10:32

Summary

jupyterlab: Image viewer in JupyterLab allows XSS when opening malicious image in new browser tab

Details

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Bitnami",
        "name": "jupyterlab",
        "purl": "pkg:bitnami/jupyterlab"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.5.10"
            },
            {
              "introduced": "4.6.0"
            },
            {
              "fixed": "4.6.2"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "severity": [
        {
          "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "type": "CVSS_V4"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-73415"
  ],
  "database_specific": {
    "cpes": [
      "cpe:2.3:a:jupyter:jupyterlab:*:*:*:*:*:python:*:*"
    ],
    "severity": "High"
  },
  "details": "jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.10 and 4.6.2, in packages/imageviewer/src/widget.ts, JupyterLab\u0027s ImageViewer uses URL.createObjectURL for a specially crafted SVG image and revokes the blob URL too early, allowing the image to retain an executable same-origin context when it is opened through the image viewer and then opened in a new browser tab. The resulting cross-site scripting can be used to execute arbitrary code on the JupyterLab server. This issue is fixed in versions 4.5.10 and 4.6.2.",
  "id": "BIT-jupyterlab-2026-73415",
  "modified": "2026-08-18T10:32:25.960Z",
  "published": "2026-08-18T10:05:56.538Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/jupyterlab/jupyterlab/commit/9365f020baec5221deaf11535ed554c06637c999"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jupyterlab/jupyterlab/commit/be9303f5bcd5308eaeae953c5a3c903046682c2c"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jupyterlab/jupyterlab/commit/f1beab4a2027af4719d6edc07d52d6cf5a39a432"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jupyterlab/jupyterlab/pull/19184"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jupyterlab/jupyterlab/pull/19185"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jupyterlab/jupyterlab/pull/19186"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.10"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.7.0a1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-gx64-gj6p-pc4c"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73415"
    }
  ],
  "schema_version": "1.6.2",
  "summary": "jupyterlab: Image viewer in JupyterLab allows XSS when opening malicious image in new browser tab"
}

BREW-JUPYTERLAB-CVE-2026-73415 (GHSA-GX64-GJ6P-PC4C)

Vulnerability from osv_homebrew – Published: 2026-08-13 17:01 – Updated: 2026-10-05 04:49 – Source website

Summary

JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab

Details

JupyterLab's image viewer allows for cross-site scripting (XSS) when a specially-crafted image file is opened through the image viewer and then opened in a new tab. This XSS issue can be used to cause remote code execution (RCE) on the JupyterLab server.

Impact

This vulnerability allows for arbitrary code execution.

Patches

JupyterLab v4.6.2 and v4.5.10 contain the patch.

Workarounds

Disable the image viewer plugin:

jupyter labextension disable @jupyterlab/imageviewer-extension:plugin

Confirm with:

jupyter labextension list

Severity

7.5 (High)


                    
                      CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

References

URL

Type

	https://github.com/jupyterlab/jupyterlab/security…	WEB
	https://github.com/jupyterlab/jupyterlab/pull/19184	WEB
	https://github.com/jupyterlab/jupyterlab/pull/19185	WEB
	https://github.com/jupyterlab/jupyterlab/pull/19186	WEB
	https://github.com/jupyterlab/jupyterlab/commit/b…	WEB
	https://github.com/jupyterlab/jupyterlab/commit/f…	WEB
	https://github.com/jupyterlab/jupyterlab	PACKAGE
	https://github.com/jupyterlab/jupyterlab/releases…	WEB
	https://github.com/jupyterlab/jupyterlab/releases…	WEB

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "fix": "bump",
        "range_state": "fixed",
        "upstream_fixed_in": "4.6.2"
      },
      "package": {
        "ecosystem": "Homebrew",
        "name": "jupyterlab",
        "purl": "pkg:brew/jupyterlab"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.6.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "confidence": "high",
    "source": "matched",
    "strategy": "registry",
    "upstream_evidence": [
      {
        "ecosystem": "PyPI",
        "key": "pkg:pypi/jupyterlab@4.6.4",
        "name": "jupyterlab",
        "strategy": "registry",
        "subject_version": "4.6.4"
      },
      {
        "ecosystem": "Debian",
        "key": "Debian/jupyterlab",
        "name": "jupyterlab",
        "strategy": "distro"
      },
      {
        "ecosystem": "PyPI",
        "key": "upstream:pkg:pypi/jupyterlab@4.6.4",
        "name": "jupyterlab",
        "strategy": "distro",
        "subject_version": "4.6.4"
      },
      {
        "ecosystem": "Ubuntu",
        "key": "Ubuntu/jupyterlab",
        "name": "jupyterlab",
        "strategy": "distro"
      }
    ]
  },
  "details": "JupyterLab\u0027s image viewer allows for cross-site scripting (XSS) when a specially-crafted image file is opened through the image viewer and then opened in a new tab. This XSS issue can be used to cause remote code execution (RCE) on the JupyterLab server.\n\n### Impact\n\nThis vulnerability allows for arbitrary code execution.\n\n### Patches\n\nJupyterLab [`v4.6.2`](https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.2) and [`v4.5.10`](https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.10) contain the patch.\n\n### Workarounds\n\nDisable the image viewer plugin:\n\n```\njupyter labextension disable @jupyterlab/imageviewer-extension:plugin\n```\n\nConfirm with:\n\n```\njupyter labextension list\n```",
  "id": "BREW-jupyterlab-CVE-2026-73415",
  "modified": "2026-10-05T04:49:24Z",
  "published": "2026-08-13T17:01:18Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-gx64-gj6p-pc4c"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jupyterlab/jupyterlab/pull/19184"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jupyterlab/jupyterlab/pull/19185"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jupyterlab/jupyterlab/pull/19186"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jupyterlab/jupyterlab/commit/be9303f5bcd5308eaeae953c5a3c903046682c2c"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jupyterlab/jupyterlab/commit/f1beab4a2027af4719d6edc07d52d6cf5a39a432"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jupyterlab/jupyterlab"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.10"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.2"
    }
  ],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab",
  "upstream": [
    "GHSA-gx64-gj6p-pc4c",
    "BIT-jupyterlab-2026-73415",
    "CVE-2026-73415",
    "PYSEC-2026-3671"
  ]
}

FKIE_CVE-2026-73415

Vulnerability from fkie_nvd - Published: 2026-08-12 20:17 - Updated: 2026-09-09 20:58

Severity

7.5 (High) - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/jupyterlab/jupyterlab/commit/9365f020baec5221deaf11535ed554c06637c999
	security-advisories@github.com	https://github.com/jupyterlab/jupyterlab/commit/be9303f5bcd5308eaeae953c5a3c903046682c2c
	security-advisories@github.com	https://github.com/jupyterlab/jupyterlab/commit/f1beab4a2027af4719d6edc07d52d6cf5a39a432
	security-advisories@github.com	https://github.com/jupyterlab/jupyterlab/pull/19184
	security-advisories@github.com	https://github.com/jupyterlab/jupyterlab/pull/19185
	security-advisories@github.com	https://github.com/jupyterlab/jupyterlab/pull/19186
	security-advisories@github.com	https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.10
	security-advisories@github.com	https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.2
	security-advisories@github.com	https://github.com/jupyterlab/jupyterlab/releases/tag/v4.7.0a1
	security-advisories@github.com	https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-gx64-gj6p-pc4c

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "jupyterlab",
          "vendor": "jupyterlab",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.5.10"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.6.0, \u003c 4.6.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.10 and 4.6.2, in packages/imageviewer/src/widget.ts, JupyterLab\u0027s ImageViewer uses URL.createObjectURL for a specially crafted SVG image and revokes the blob URL too early, allowing the image to retain an executable same-origin context when it is opened through the image viewer and then opened in a new browser tab. The resulting cross-site scripting can be used to execute arbitrary code on the JupyterLab server. This issue is fixed in versions 4.5.10 and 4.6.2."
    }
  ],
  "id": "CVE-2026-73415",
  "lastModified": "2026-09-09T20:58:37.713",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "HIGH",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "ACTIVE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "LOW",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-73415",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-12T20:35:03.166189Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-12T20:17:56.660",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/jupyterlab/jupyterlab/commit/9365f020baec5221deaf11535ed554c06637c999"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/jupyterlab/jupyterlab/commit/be9303f5bcd5308eaeae953c5a3c903046682c2c"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/jupyterlab/jupyterlab/commit/f1beab4a2027af4719d6edc07d52d6cf5a39a432"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/jupyterlab/jupyterlab/pull/19184"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/jupyterlab/jupyterlab/pull/19185"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/jupyterlab/jupyterlab/pull/19186"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.10"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.7.0a1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-gx64-gj6p-pc4c"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-GX64-GJ6P-PC4C

Vulnerability from github – Published: 2026-07-22 23:14 – Updated: 2026-08-12 19:54

Summary

JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab

Details

Impact

This vulnerability allows for arbitrary code execution.

Patches

JupyterLab v4.6.2 and v4.5.10 contain the patch.

Workarounds

Disable the image viewer plugin:

jupyter labextension disable @jupyterlab/imageviewer-extension:plugin

Confirm with:

jupyter labextension list

Severity

7.5 (High)


                  
                    CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.6.1"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "jupyterlab"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.6.0"
            },
            {
              "fixed": "4.6.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.5.9"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "jupyterlab"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.5.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-73415"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-22T23:14:44Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "JupyterLab\u0027s image viewer allows for cross-site scripting (XSS) when a specially-crafted image file is opened through the image viewer and then opened in a new tab. This XSS issue can be used to cause remote code execution (RCE) on the JupyterLab server.\n\n### Impact\n\nThis vulnerability allows for arbitrary code execution.\n\n### Patches\n\nJupyterLab [`v4.6.2`](https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.2) and [`v4.5.10`](https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.10) contain the patch.\n\n### Workarounds\n\nDisable the image viewer plugin:\n\n```\njupyter labextension disable @jupyterlab/imageviewer-extension:plugin\n```\n\nConfirm with:\n\n```\njupyter labextension list\n```",
  "id": "GHSA-gx64-gj6p-pc4c",
  "modified": "2026-08-12T19:54:08Z",
  "published": "2026-07-22T23:14:44Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-gx64-gj6p-pc4c"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jupyterlab/jupyterlab/pull/19184"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jupyterlab/jupyterlab/pull/19185"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jupyterlab/jupyterlab/pull/19186"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jupyterlab/jupyterlab/commit/be9303f5bcd5308eaeae953c5a3c903046682c2c"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jupyterlab/jupyterlab/commit/f1beab4a2027af4719d6edc07d52d6cf5a39a432"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jupyterlab/jupyterlab"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.10"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab"
}

OPENSUSE-SU-2026:11634-1

Vulnerability from csaf_opensuse - Published: 2026-08-28 00:00 - Updated: 2026-09-17 17:21

Summary

jupyter-jupyterlab-4.5.10-1.1 on GA media

Severity

Moderate

Scope

5 vulnerabilities in this advisory, including CVE-2026-73415.

CVE-2026-73415

Recommended: 12 products

Open the full advisory

PYSEC-2026-3671

Vulnerability from pysec - Published: 2026-08-19 11:56 - Updated: 2026-08-19 12:16

Details

Impact

This vulnerability allows for arbitrary code execution.

Patches

JupyterLab v4.6.2 and v4.5.10 contain the patch.

Workarounds

Disable the image viewer plugin:

jupyter labextension disable @jupyterlab/imageviewer-extension:plugin

Confirm with:

jupyter labextension list

Severity

7.5 (High)


                  
                    CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Impacted products

Name	purl
jupyterlab	pkg:pypi/jupyterlab

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "jupyterlab",
        "purl": "pkg:pypi/jupyterlab"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.5.10"
            },
            {
              "introduced": "4.6.0"
            },
            {
              "fixed": "4.6.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.0.1",
        "0.0.10",
        "0.0.13",
        "0.0.2",
        "0.0.3",
        "0.0.4",
        "0.0.5",
        "0.0.6",
        "0.0.7",
        "0.0.8",
        "0.0.9",
        "0.1.1",
        "0.1.2",
        "0.10.0",
        "0.11.0",
        "0.11.1",
        "0.11.2",
        "0.11.3",
        "0.12.0",
        "0.12.1",
        "0.13.0",
        "0.13.1",
        "0.13.2",
        "0.14.0",
        "0.15.0",
        "0.15.1",
        "0.16.0",
        "0.16.2",
        "0.17.0",
        "0.17.1",
        "0.17.2",
        "0.17.4",
        "0.17.5",
        "0.18.0",
        "0.18.0.dev1",
        "0.18.1",
        "0.19.0",
        "0.2.0",
        "0.20.0",
        "0.20.0rc1",
        "0.20.1",
        "0.20.2",
        "0.20.3",
        "0.20.4",
        "0.21.0",
        "0.21.0rc1",
        "0.21.0rc2",
        "0.21.0rc3",
        "0.21.0rc4",
        "0.21.0rc5",
        "0.22.0",
        "0.22.0rc0",
        "0.22.1",
        "0.23.0",
        "0.23.0rc0",
        "0.23.0rc1",
        "0.23.1",
        "0.23.2",
        "0.24.0",
        "0.24.0rc0",
        "0.24.0rc1",
        "0.24.0rc2",
        "0.24.1",
        "0.25.0",
        "0.25.0rc0",
        "0.25.0rc1",
        "0.25.1",
        "0.25.2",
        "0.25.2rc0",
        "0.26.0",
        "0.26.0rc0",
        "0.26.0rc1",
        "0.26.1",
        "0.26.2",
        "0.26.3",
        "0.26.4",
        "0.26.5",
        "0.27.0",
        "0.27.0rc0",
        "0.27.0rc1",
        "0.27.0rc2",
        "0.27.0rc3",
        "0.27.0rc4",
        "0.27.0rc5",
        "0.27.1",
        "0.27.2",
        "0.28.0",
        "0.28.0rc0",
        "0.28.0rc1",
        "0.28.0rc2",
        "0.28.0rc3",
        "0.28.1",
        "0.28.10",
        "0.28.11",
        "0.28.12",
        "0.28.13",
        "0.28.14",
        "0.28.15",
        "0.28.2",
        "0.28.3",
        "0.28.4",
        "0.28.5",
        "0.28.6",
        "0.28.7",
        "0.28.8",
        "0.29.0",
        "0.29.0rc0",
        "0.29.1",
        "0.29.2",
        "0.3.0",
        "0.30.0",
        "0.30.0rc0",
        "0.30.0rc1",
        "0.30.1",
        "0.30.2",
        "0.30.3",
        "0.30.4",
        "0.30.5",
        "0.30.6",
        "0.31.0",
        "0.31.0rc0",
        "0.31.0rc1",
        "0.31.0rc2",
        "0.31.1",
        "0.31.10",
        "0.31.11",
        "0.31.12",
        "0.31.2",
        "0.31.3",
        "0.31.4",
        "0.31.5",
        "0.31.6",
        "0.31.7",
        "0.31.8",
        "0.31.9",
        "0.32.0",
        "0.32.0rc0",
        "0.32.0rc1",
        "0.32.1",
        "0.33.0",
        "0.33.0rc0",
        "0.33.0rc1",
        "0.33.1",
        "0.33.10",
        "0.33.11",
        "0.33.12",
        "0.33.2",
        "0.33.3",
        "0.33.4",
        "0.33.5",
        "0.33.6",
        "0.33.7",
        "0.33.8",
        "0.33.9",
        "0.34.0",
        "0.34.0rc0",
        "0.34.0rc1",
        "0.34.0rc2",
        "0.34.1",
        "0.34.10",
        "0.34.11",
        "0.34.12",
        "0.34.2",
        "0.34.3",
        "0.34.4",
        "0.34.5",
        "0.34.6",
        "0.34.7",
        "0.34.8",
        "0.34.9",
        "0.35.0",
        "0.35.0rc0",
        "0.35.0rc1",
        "0.35.0rc2",
        "0.35.1",
        "0.35.2",
        "0.35.3",
        "0.35.4",
        "0.35.5",
        "0.35.6",
        "0.4.0",
        "0.4.1",
        "0.5.0",
        "0.6.0",
        "0.7.0",
        "0.8.0",
        "0.9.0",
        "0.9.1",
        "1.0.0",
        "1.0.0a0",
        "1.0.0a1",
        "1.0.0a10",
        "1.0.0a2",
        "1.0.0a3",
        "1.0.0a4",
        "1.0.0a5",
        "1.0.0a6",
        "1.0.0a7",
        "1.0.0a8",
        "1.0.0a9",
        "1.0.0rc0",
        "1.0.0rc1",
        "1.0.1",
        "1.0.10",
        "1.0.2",
        "1.0.3",
        "1.0.4",
        "1.0.5",
        "1.0.6",
        "1.0.7",
        "1.0.9",
        "1.1.0",
        "1.1.0a0",
        "1.1.0a1",
        "1.1.0a2",
        "1.1.0rc0",
        "1.1.1",
        "1.1.2",
        "1.1.3",
        "1.1.4",
        "1.1.5",
        "1.2.0",
        "1.2.0a0",
        "1.2.0a1",
        "1.2.0a2",
        "1.2.0a3",
        "1.2.0rc0",
        "1.2.1",
        "1.2.10",
        "1.2.11",
        "1.2.12",
        "1.2.13",
        "1.2.14",
        "1.2.15",
        "1.2.16",
        "1.2.17",
        "1.2.18",
        "1.2.19",
        "1.2.2",
        "1.2.20",
        "1.2.21",
        "1.2.3",
        "1.2.4",
        "1.2.5",
        "1.2.6",
        "1.2.7",
        "1.2.8",
        "1.2.9",
        "2.0.0",
        "2.0.0a0",
        "2.0.0a1",
        "2.0.0a3",
        "2.0.0a4",
        "2.0.0b1",
        "2.0.0b2",
        "2.0.0b3",
        "2.0.0rc0",
        "2.0.0rc1",
        "2.0.0rc2",
        "2.0.1",
        "2.0.1rc0",
        "2.0.2",
        "2.1.0",
        "2.1.0a0",
        "2.1.0b0",
        "2.1.0rc0",
        "2.1.1",
        "2.1.2",
        "2.1.3",
        "2.1.4",
        "2.1.5",
        "2.2.0",
        "2.2.0a0",
        "2.2.0a1",
        "2.2.0rc1",
        "2.2.1",
        "2.2.10",
        "2.2.2",
        "2.2.4",
        "2.2.5",
        "2.2.6",
        "2.2.7",
        "2.2.8",
        "2.2.9",
        "2.3.0",
        "2.3.0a0",
        "2.3.0a1",
        "2.3.0a2",
        "2.3.0rc0",
        "2.3.1",
        "2.3.2",
        "3.0.0",
        "3.0.0a0",
        "3.0.0a10",
        "3.0.0a11",
        "3.0.0a12",
        "3.0.0a13",
        "3.0.0a14",
        "3.0.0a3",
        "3.0.0a4",
        "3.0.0a5",
        "3.0.0a6",
        "3.0.0a7",
        "3.0.0a8",
        "3.0.0a9",
        "3.0.0b1",
        "3.0.0b2",
        "3.0.0b3",
        "3.0.0b4",
        "3.0.0b6",
        "3.0.0b7",
        "3.0.0b8",
        "3.0.0rc0",
        "3.0.0rc1",
        "3.0.0rc10",
        "3.0.0rc11",
        "3.0.0rc12",
        "3.0.0rc13",
        "3.0.0rc14",
        "3.0.0rc15",
        "3.0.0rc2",
        "3.0.0rc3",
        "3.0.0rc4",
        "3.0.0rc5",
        "3.0.0rc6",
        "3.0.0rc7",
        "3.0.0rc8",
        "3.0.0rc9",
        "3.0.1",
        "3.0.10",
        "3.0.11",
        "3.0.12",
        "3.0.13",
        "3.0.14",
        "3.0.15",
        "3.0.16",
        "3.0.17",
        "3.0.18",
        "3.0.2",
        "3.0.3",
        "3.0.4",
        "3.0.5",
        "3.0.6",
        "3.0.7",
        "3.0.8",
        "3.0.9",
        "3.1.0",
        "3.1.0a0",
        "3.1.0a1",
        "3.1.0a10",
        "3.1.0a11",
        "3.1.0a12",
        "3.1.0a13",
        "3.1.0a2",
        "3.1.0a3",
        "3.1.0a4",
        "3.1.0a5",
        "3.1.0a6",
        "3.1.0a7",
        "3.1.0a8",
        "3.1.0a9",
        "3.1.0b0",
        "3.1.0b1",
        "3.1.0rc1",
        "3.1.0rc2",
        "3.1.1",
        "3.1.10",
        "3.1.11",
        "3.1.12",
        "3.1.13",
        "3.1.14",
        "3.1.16",
        "3.1.17",
        "3.1.18",
        "3.1.19",
        "3.1.2",
        "3.1.4",
        "3.1.6",
        "3.1.7",
        "3.1.8",
        "3.1.9",
        "3.2.0",
        "3.2.0a0",
        "3.2.0a1",
        "3.2.0b0",
        "3.2.0rc0",
        "3.2.1",
        "3.2.2",
        "3.2.3",
        "3.2.4",
        "3.2.5",
        "3.2.6",
        "3.2.7",
        "3.2.8",
        "3.2.9",
        "3.3.0",
        "3.3.0a1",
        "3.3.0a2",
        "3.3.0a3",
        "3.3.0b0",
        "3.3.0rc0",
        "3.3.1",
        "3.3.2",
        "3.3.3",
        "3.3.4",
        "3.4.0",
        "3.4.0a0",
        "3.4.0b0",
        "3.4.0rc0",
        "3.4.1",
        "3.4.2",
        "3.4.3",
        "3.4.4",
        "3.4.5",
        "3.4.6",
        "3.4.7",
        "3.4.8",
        "3.5.0",
        "3.5.0a0",
        "3.5.0b0",
        "3.5.0rc0",
        "3.5.1",
        "3.5.2",
        "3.5.3",
        "3.6.0",
        "3.6.0a0",
        "3.6.0a1",
        "3.6.0a2",
        "3.6.0a3",
        "3.6.0a4",
        "3.6.0a5",
        "3.6.0b0",
        "3.6.0rc0",
        "3.6.0rc1",
        "3.6.1",
        "3.6.2",
        "3.6.3",
        "3.6.4",
        "3.6.5",
        "3.6.6",
        "3.6.7",
        "3.6.8",
        "4.0.0",
        "4.0.0a0",
        "4.0.0a1",
        "4.0.0a10",
        "4.0.0a11",
        "4.0.0a12",
        "4.0.0a13",
        "4.0.0a14",
        "4.0.0a15",
        "4.0.0a16",
        "4.0.0a17",
        "4.0.0a18",
        "4.0.0a19",
        "4.0.0a20",
        "4.0.0a21",
        "4.0.0a22",
        "4.0.0a23",
        "4.0.0a24",
        "4.0.0a25",
        "4.0.0a26",
        "4.0.0a27",
        "4.0.0a28",
        "4.0.0a29",
        "4.0.0a3",
        "4.0.0a30",
        "4.0.0a31",
        "4.0.0a32",
        "4.0.0a33",
        "4.0.0a34",
        "4.0.0a35",
        "4.0.0a36",
        "4.0.0a4",
        "4.0.0a6",
        "4.0.0a7",
        "4.0.0a8",
        "4.0.0a9",
        "4.0.0b0",
        "4.0.0b1",
        "4.0.0b2",
        "4.0.0rc0",
        "4.0.0rc1",
        "4.0.1",
        "4.0.10",
        "4.0.11",
        "4.0.12",
        "4.0.13",
        "4.0.2",
        "4.0.3",
        "4.0.4",
        "4.0.5",
        "4.0.6",
        "4.0.7",
        "4.0.8",
        "4.0.9",
        "4.1.0",
        "4.1.0a1",
        "4.1.0a2",
        "4.1.0a3",
        "4.1.0a4",
        "4.1.0b0",
        "4.1.0b1",
        "4.1.0b2",
        "4.1.0rc0",
        "4.1.0rc1",
        "4.1.1",
        "4.1.2",
        "4.1.3",
        "4.1.4",
        "4.1.5",
        "4.1.6",
        "4.1.7",
        "4.1.8",
        "4.2.0",
        "4.2.0a0",
        "4.2.0a1",
        "4.2.0a2",
        "4.2.0b0",
        "4.2.0b1",
        "4.2.0b2",
        "4.2.0b3",
        "4.2.0rc0",
        "4.2.1",
        "4.2.2",
        "4.2.3",
        "4.2.4",
        "4.2.5",
        "4.2.6",
        "4.2.7",
        "4.3.0",
        "4.3.0a0",
        "4.3.0a1",
        "4.3.0a2",
        "4.3.0b0",
        "4.3.0b1",
        "4.3.0b2",
        "4.3.0b3",
        "4.3.0rc0",
        "4.3.0rc1",
        "4.3.1",
        "4.3.2",
        "4.3.3",
        "4.3.4",
        "4.3.5",
        "4.3.6",
        "4.3.7",
        "4.3.8",
        "4.4.0",
        "4.4.0a0",
        "4.4.0a1",
        "4.4.0a2",
        "4.4.0a3",
        "4.4.0b0",
        "4.4.0b1",
        "4.4.0b2",
        "4.4.0rc0",
        "4.4.0rc1",
        "4.4.1",
        "4.4.10",
        "4.4.2",
        "4.4.3",
        "4.4.4",
        "4.4.5",
        "4.4.6",
        "4.4.7",
        "4.4.8",
        "4.4.9",
        "4.5.0",
        "4.5.0a0",
        "4.5.0a1",
        "4.5.0a2",
        "4.5.0a3",
        "4.5.0a4",
        "4.5.0b0",
        "4.5.0b1",
        "4.5.0rc0",
        "4.5.0rc1",
        "4.5.1",
        "4.5.2",
        "4.5.3",
        "4.5.4",
        "4.5.5",
        "4.5.6",
        "4.5.7",
        "4.5.8",
        "4.5.9",
        "4.6.0",
        "4.6.1"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-73415",
    "GHSA-gx64-gj6p-pc4c"
  ],
  "details": "JupyterLab\u0027s image viewer allows for cross-site scripting (XSS) when a specially-crafted image file is opened through the image viewer and then opened in a new tab. This XSS issue can be used to cause remote code execution (RCE) on the JupyterLab server.\n\n### Impact\n\nThis vulnerability allows for arbitrary code execution.\n\n### Patches\n\nJupyterLab [`v4.6.2`](https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.2) and [`v4.5.10`](https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.10) contain the patch.\n\n### Workarounds\n\nDisable the image viewer plugin:\n\n```\njupyter labextension disable @jupyterlab/imageviewer-extension:plugin\n```\n\nConfirm with:\n\n```\njupyter labextension list\n```",
  "id": "PYSEC-2026-3671",
  "modified": "2026-08-19T12:16:26.380824Z",
  "published": "2026-08-19T11:56:25.364725Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-gx64-gj6p-pc4c"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jupyterlab/jupyterlab/pull/19184"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jupyterlab/jupyterlab/pull/19185"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jupyterlab/jupyterlab/pull/19186"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jupyterlab/jupyterlab/commit/be9303f5bcd5308eaeae953c5a3c903046682c2c"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jupyterlab/jupyterlab/commit/f1beab4a2027af4719d6edc07d52d6cf5a39a432"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jupyterlab/jupyterlab"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.10"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.2"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/jupyterlab"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-gx64-gj6p-pc4c"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73415"
    }
  ],
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab"
}

RHSA-2026:65126

Vulnerability from csaf_redhat - Published: 2026-09-08 07:57 - Updated: 2026-10-19 21:40

Summary

Red Hat Security Advisory: RHOAI 2.25.11 - Red Hat OpenShift AI

Severity

Important

Scope

117 vulnerabilities in this advisory, including CVE-2026-73415.

CVE-2026-73415

A flaw was found in JupyterLab. The ImageViewer component improperly handles specially crafted SVG images by revoking a blob URL too early. This allows a remote attacker to exploit a cross-site scripting (XSS) vulnerability when a malicious image is opened through the image viewer and subsequently in a new browser tab. Successful exploitation could lead to arbitrary code execution on the JupyterLab server.

8.0 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

Fixed: 23 products Known not affected: 186 products

https://access.redhat.com/errata/RHSA-2026:65126

Open the full advisory

RHSA-2026:73987

Vulnerability from csaf_redhat - Published: 2026-09-30 13:36 - Updated: 2026-10-19 21:41

Summary

Red Hat Security Advisory: RHOAI 3.3.7 - Red Hat OpenShift AI

Severity

Critical

Scope

125 vulnerabilities in this advisory, including CVE-2026-73415.

CVE-2026-73415

8.0 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

Fixed: 24 products Known not affected: 211 products

https://access.redhat.com/errata/RHSA-2026:73987

Open the full advisory

RHSA-2026:84734

Vulnerability from csaf_redhat - Published: 2026-10-19 08:52 - Updated: 2026-10-19 21:41

Summary

Red Hat Security Advisory: RHOAI 3.4.5 - Red Hat OpenShift AI

Severity

Critical

Scope

298 vulnerabilities in this advisory, including CVE-2026-73415.

CVE-2026-73415

8.0 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

Fixed: 29 products Known not affected: 292 products

https://access.redhat.com/errata/RHSA-2026:84734

Open the full advisory

UBUNTU-CVE-2026-73415 (CVE-2026-73415)

Vulnerability from osv_ubuntu – Published: 2026-08-12 20:17 – Updated: 2026-09-30 21:32 – Source website

Details

Severity

7.5 (High)


                    
                      CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-73415	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-73415	REPORT
	https://github.com/jupyterlab/jupyterlab/security…	REPORT
	https://github.com/jupyterlab/jupyterlab/pull/19186	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "jupyterlab",
            "binary_version": "4.0.11+ds1+~cs11.25.27-9"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "jupyterlab",
        "purl": "pkg:deb/ubuntu/jupyterlab@4.0.11+ds1+~cs11.25.27-9?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.0.11+ds1+~cs11.25.27-7",
        "4.0.11+ds1+~cs11.25.27-8",
        "4.0.11+ds1+~cs11.25.27-9"
      ]
    }
  ],
  "aliases": [],
  "details": "jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.10 and 4.6.2, in packages/imageviewer/src/widget.ts, JupyterLab\u0027s ImageViewer uses URL.createObjectURL for a specially crafted SVG image and revokes the blob URL too early, allowing the image to retain an executable same-origin context when it is opened through the image viewer and then opened in a new browser tab. The resulting cross-site scripting can be used to execute arbitrary code on the JupyterLab server. This issue is fixed in versions 4.5.10 and 4.6.2.",
  "id": "UBUNTU-CVE-2026-73415",
  "modified": "2026-09-30T21:32:09Z",
  "published": "2026-08-12T20:17:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-73415"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-73415"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-gx64-gj6p-pc4c"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/jupyterlab/jupyterlab/pull/19186"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-73415"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-73415 (GCVE-0-2026-73415)

Vulnerability from bitnami_vulndb

BREW-JUPYTERLAB-CVE-2026-73415 (GHSA-GX64-GJ6P-PC4C)

Impact

Patches

Workarounds

Impact

Patches

Workarounds

Impact

Patches

Workarounds

UBUNTU-CVE-2026-73415 (CVE-2026-73415)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour