{"id":"GHSA-gx64-gj6p-pc4c","title":"JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab","summary":"JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab","severity":"high","cwe":["CWE-79"],"vendor":"jupyterlab","product":"jupyterlab","ecosystem":"pip","affected":["jupyterlab >= 4.6.0, <= 4.6.1","jupyterlab <= 4.5.9"],"patched":["jupyterlab 4.6.2","jupyterlab 4.5.10"],"published":"2026-07-22","updated":"2026-07-22","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-gx64-gj6p-pc4c","references":[{"url":"https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-gx64-gj6p-pc4c"},{"url":"https://github.com/jupyterlab/jupyterlab/pull/19184"},{"url":"https://github.com/jupyterlab/jupyterlab/pull/19185"},{"url":"https://github.com/jupyterlab/jupyterlab/pull/19186"},{"url":"https://github.com/jupyterlab/jupyterlab/commit/be9303f5bcd5308eaeae953c5a3c903046682c2c"},{"url":"https://github.com/jupyterlab/jupyterlab/commit/f1beab4a2027af4719d6edc07d52d6cf5a39a432"},{"url":"https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.10"},{"url":"https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.2"},{"url":"https://github.com/advisories/GHSA-gx64-gj6p-pc4c"}],"tags":["ghsa","pip"],"ingestedAt":"2026-07-23T00:08:38.808Z","slug":"GHSA-gx64-gj6p-pc4c","body":"## Overview\n\nJupyterLab's image viewer allows for cross-site scripting (XSS) when a specially-crafted image file is opened through the image viewer and then opened in a new tab. This XSS issue can be used to cause remote code execution (RCE) on the JupyterLab server.\n\n### Impact\n\nThis vulnerability allows for arbitrary code execution.\n\n### Patches\n\nJupyterLab [`v4.6.2`](https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.2) and [`v4.5.10`](https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.10) contain the patch.\n\n### Workarounds\n\nDisable the image viewer plugin:\n\n```\njupyter labextension disable @jupyterlab/imageviewer-extension:plugin\n```\n\nConfirm with:\n\n```\njupyter labextension list\n```\n\n## Affected packages\n\n- `jupyterlab >= 4.6.0, <= 4.6.1`\n- `jupyterlab <= 4.5.9`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `jupyterlab 4.6.2`\n- `jupyterlab 4.5.10`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}