Securaity Browse advisories
SA-26-388 High

Jupyter: JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab

Jupyter

More for Jupyter RSS feed for Jupyter

Severity
High, CVSS 7.5
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Record
CVE-2026-73415
Affects
Jupyter
Known exploited
Not listed in the CISA Known Exploited Vulnerabilities catalog
Published
Record first published by the source
July 22, 2026
Source last modified
August 12, 2026

Description

JupyterLab's image viewer allows for cross-site scripting (XSS) when a specially-crafted image file is opened through the image viewer and then opened in a new tab. This XSS issue can be used to cause remote code execution (RCE) on the JupyterLab server.

Impact

This vulnerability allows for arbitrary code execution.

Patches

JupyterLab [v4.6.2](https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.2) and [v4.5.10](https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.10) contain the patch.

Workarounds

Disable the image viewer plugin:

jupyter labextension disable @jupyterlab/imageviewer-extension:plugin

Confirm with:

jupyter labextension list

Description quoted from the NVD record.

Who is affected

Jupyter (also called JupyterLab) is a tool for writing and running code and notes together in a web browser. This flaw is in its image viewer, the part that displays pictures. If someone opens a specially crafted image file in the image viewer and then opens it in a new browser tab, hidden code in the image can run in the browser. An attacker can use that to run any code they want on the server where JupyterLab runs. The flaw is fixed in versions v4.6.2 and v4.5.10. This flaw is rated High.

What to do

  1. The person who installed or runs JupyterLab for your organization should act on this. If an IT provider or vendor runs it for you, send them this advisory and ask when the update will be done.
  2. Update JupyterLab to version v4.6.2 or v4.5.10. Both contain the fix for this flaw.
  3. If you cannot update right away, turn off the image viewer plugin by running the command jupyter labextension disable @jupyterlab/imageviewer-extension:plugin. Then run jupyter labextension list to check that it is off.

Analysis written from the source record as of August 12, 2026 and reviewed before publishing.

Sources

MORE ADVISORIES

See all