GHSA-gx64-gj6p-pc4cHigh▾ TwilightJupyterLab: Image viewer allows XSS when opening malicious image in new browser tab
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
JupyterLab's image viewer allows for cross-site scripting (XSS) when a specially-crafted image file is opened through the image viewer and then opened in a new tab. This XSS issue can be used to cause remote code execution (RCE) on the JupyterLab server.
This vulnerability allows for arbitrary code execution.
JupyterLab v4.6.2 and v4.5.10 contain the patch.
Disable the image viewer plugin:
jupyter labextension disable @jupyterlab/imageviewer-extension:plugin
Confirm with:
jupyter labextension list
jupyterlab >= 4.6.0, <= 4.6.1jupyterlab <= 4.5.9Upgrade to a patched release:
jupyterlab 4.6.2jupyterlab 4.5.10Connected by shared product, vendor, weakness, or advisory.
CVE-2026-73417High· 8.3jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture
GHSA-pppj-hq3g-57pjHighJupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)
CVE-2026-73626High· 7.5JupyterLab versions >=4.6.0,<=4.6.1 and <=4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install()
CVE-2026-73416Mediumjupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture
GHSA-whvh-wf3x-g77jLowJupyterLab: Allowlist/blocklist check in `PyPIExtensionManager.install()` not enforced for direct callers (missing `await`)
GHSA-h5v5-8746-g7mmMediumJupyterLab PluginManager lock-rule enforcement bypass