CVE-2026-73415

Received Received - Intake

XSS in JupyterLab ImageViewer via SVG Handling

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: GitHub, Inc.

Description

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.10 and 4.6.2, in packages/imageviewer/src/widget.ts, JupyterLab's ImageViewer uses URL.createObjectURL for a specially crafted SVG image and revokes the blob URL too early, allowing the image to retain an executable same-origin context when it is opened through the image viewer and then opened in a new browser tab. The resulting cross-site scripting can be used to execute arbitrary code on the JupyterLab server. This issue is fixed in versions 4.5.10 and 4.6.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-12

Generated

2026-09-02

AI Q&A

2026-08-13

EPSS Evaluated

2026-08-31

NVD

CVE-2026-73415

EUVD

EUVD-2026-57535

Affected Vendors & Products

Vendor	Product	Version / Range
jupyterlab	jupyterlab	to 4.5.10 (inc)
jupyterlab	jupyterlab	to 4.6.2 (inc)
jupyterlab	jupyterlab	4.5.10
jupyterlab	jupyterlab	4.6.2
jupyterlab	jupyterlab	From 4.5.0 (inc) to 4.6.2 (exc)
jupyterlab	jupyterlab	From 4.6.0 (inc) to 4.6.2 (exc)
jupyterlab	jupyterlab	4.7.0a1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability in JupyterLab involves a cross-site scripting (XSS) flaw in the image viewer. When a specially crafted SVG image is opened in the image viewer and then accessed in a new browser tab, it can execute arbitrary code on the JupyterLab server. The issue occurs because the image retains an executable same-origin context due to early revocation of a blob URL.

Detection Guidance

Check JupyterLab version with: jupyter lab --version. If using 4.6.0-4.6.1 or 4.5.0-4.5.9, the system is vulnerable. Inspect browser console logs when opening SVG images in the image viewer for XSS errors.

Impact Analysis

If exploited, this vulnerability could allow attackers to execute arbitrary code on your JupyterLab server. This may lead to unauthorized access, data theft, or further compromise of your system. Users running vulnerable versions (4.5.0 to 4.5.9 and 4.6.0 to 4.6.1) are at risk.

Compliance Impact

The vulnerability allows cross-site scripting (XSS) attacks through malicious SVG images, which could lead to unauthorized code execution on the JupyterLab server. This poses risks to data confidentiality and integrity, potentially violating GDPR's data protection requirements and HIPAA's safeguards for protected health information if sensitive data is processed in affected environments.

Mitigation Strategies

Upgrade JupyterLab to version 4.6.2 or 4.5.10 immediately. As a temporary workaround, disable the image viewer plugin with: jupyter labextension disable @jupyterlab/imageviewer-extension:plugin.

Hi! I’m here to help you understand CVE-2026-73415. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70