Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.9
CVE-2026-73415: JupyterLab image viewer can run code via malicious SVG
CVE-2026-73415 · published 2 months ago
Summary
The image viewer in JupyterLab (versions before 4.5.10 and 4.6.2) can be tricked by a specially crafted SVG file to execute code on the server when the image is opened in a new browser tab. This could let an attacker run arbitrary commands inside your JupyterLab environment. Update JupyterLab to version 4.5.10 or later (or 4.6.2 or later) to fix the issue.
What to do
- Update jupyterlab to version 4.6.2.
- Update debian jupyterlab to version 4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-4.
- Update jupyter development team jupyterlab to version 4.6.2.
- Update jupyter development team jupyterlab to version 4.5.10.
- Update jupyterlab to version 4.5.10.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | jupyterlab | jupyterlab | < 4.5.10 |
| Bitnami | – | jupyterlab |
>= 4.6.0, < 4.6.2 Fix: upgrade to 4.6.2
|
| Debian:13 | debian | jupyterlab | All versions |
| Debian:14 | debian | jupyterlab |
< 4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-4 Fix: upgrade to 4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-4
|
| pip | jupyter development team | jupyterlab |
>= 4.6.0, <= 4.6.1 <= 4.5.9 Fix: upgrade to 4.6.2
|
| PyPI | – | jupyterlab |
< 4.5.10 Fix: upgrade to 4.5.10
|
| Ubuntu:26.04:LTS | canonical | jupyterlab | All versions |
Original advisory text
jupyterlab: Image viewer in JupyterLab allows XSS when opening malicious image in new browser tab
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.10 and 4.6.2, in packages/imageviewer/src/widget.ts, JupyterLab's ImageViewer uses URL.createObjectURL for a specially crafted SVG image and revokes the blob URL too early, allowing the image to retain an executable same-origin context when it is opened through the image viewer and then opened in a new browser tab. The resulting cross-site scripting can be used to execute arbitrary code on the JupyterLab server. This issue is fixed in versions 4.5.10 and 4.6.2.
References
- https://github.com/jupyterlab/jupyterlab/pull/19184 Patch
- https://github.com/advisories/GHSA-gx64-gj6p-pc4c
- https://github.com/jupyterlab/jupyterlab/commit/9365f020baec5221deaf11535ed554c0... Patch
- https://github.com/jupyterlab/jupyterlab Product
- https://security-tracker.debian.org/tracker/CVE-2026-73415 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73415... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-73415 Vendor Advisory
- https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.10 URL
- https://github.com/jupyterlab/jupyterlab/releases/tag/v4.7.0a1 URL
- https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-gx64-gj6p-pc4c Vendor Advisory
- https://ubuntu.com/security/CVE-2026-73415 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-73415 Third Party Advisory
- https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.2 URL
- https://github.com/jupyterlab/jupyterlab/commit/be9303f5bcd5308eaeae953c5a3c9030... Patch
- https://github.com/jupyterlab/jupyterlab/commit/f1beab4a2027af4719d6edc07d52d6cf... Patch
- https://github.com/jupyterlab/jupyterlab/pull/19185 Patch
- https://github.com/jupyterlab/jupyterlab/pull/19186 Patch
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published12 Aug 2026
Updated4 Nov 2026
First seen22 Jul 2026
Sources
DEBIAN-CVE-2026-73415 · OSV
GHSA-gx64-gj6p-pc4c · GHSA
CVE-2026-73415 · OSV
CVE-2026-73415 · NVD
CVE-2026-73415 · MITRE
UBUNTU-CVE-2026-73415 · OSV
Track software like this
Free during beta