CVE-2026-73415: jupyterlab: Image viewer in JupyterLab allows XSS when opening malicious image in new browser tab
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.10 and 4.6.2, in packages/imageviewer/src/widget.ts, JupyterLab's ImageViewer uses URL.createObjectURL for a specially crafted SVG image and revokes the blob URL too early, allowing the image to retain an executable same-origin context when it is opened through the image viewer and then opened in a new browser tab. The resulting cross-site scripting can be used to execute arbitrary code on the JupyterLab server. This issue is fixed in versions 4.5.10 and 4.6.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
jupyterlabto a version that resolves this vulnerability.Fixed in 4.5.10 - Upgrade
Upgrade
jupyterlabto a version that resolves this vulnerability.Fixed in 4.6.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73415?
CVE-2026-73415 has a risk rating of 58, indicating a moderate severity level.
How do I fix CVE-2026-73415?
To mitigate CVE-2026-73415, upgrade JupyterLab to versions 4.5.10 or 4.6.2 or later.
What type of vulnerability is identified in CVE-2026-73415?
CVE-2026-73415 is an XSS (Cross-Site Scripting) vulnerability that allows the execution of malicious scripts.
What components are affected by CVE-2026-73415?
The vulnerability affects the ImageViewer component of JupyterLab prior to versions 4.5.10 and 4.6.2.
How does CVE-2026-73415 impact users of JupyterLab?
Users may be exposed to XSS attacks when opening maliciously crafted SVG images in a new browser tab.