CVE-2026-73415

HIGH

jupyterlab: Image viewer in JupyterLab allows XSS when opening malicious image in new browser tab

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2026-73415 has a selected CVSS score of 7.5 (high).

Description

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.10 and 4.6.2, in packages/imageviewer/src/widget.ts, JupyterLab's ImageViewer uses URL.createObjectURL for a specially crafted SVG image and revokes the blob URL too early, allowing the image to retain an executable same-origin context when it is opened through the image viewer and then opened in a new browser tab. The resulting cross-site scripting can be used to execute arbitrary code on the JupyterLab server. This issue is fixed in versions 4.5.10 and 4.6.2.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 12, 2026 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

jupyterlab

Browse jupyterlab / jupyterlab
CVE List< 4.5.10affected
>= 4.6.0, < 4.6.2affected

jupyterlab

Browse PyPI / jupyterlab
GitHub Advisory4.6.0 to < 4.6.2 · Fixed in 4.6.2affected
Before 4.5.10 · Fixed in 4.5.10affected

References

11