CVE-2026-73415
published 2026-08-12CVE-2026-73415: jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.10 and 4.6.2, in…
PriorityP346high7.5CVSS 4.0
AVNACHATNPRNUIAVCHVIHVALSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.74%
54.0th percentile
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.10 and 4.6.2, in packages/imageviewer/src/widget.ts, JupyterLab's ImageViewer uses URL.createObjectURL for a specially crafted SVG image and revokes the blob URL too early, allowing the image to retain an executable same-origin context when it is opened through the image viewer and then opened in a new browser tab. The resulting cross-site scripting can be used to execute arbitrary code on the JupyterLab server. This issue is fixed in versions 4.5.10 and 4.6.2.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jupyterlab | jupyterlab | < 4.5.10 | 4.5.10 |
| jupyterlab | jupyterlab | — | — |
| mta | mta-solution-server-rhel9 | — | — |
| rhoai | odh-feature-server-rhel9 | — | — |
| rhoai | odh-th06-cpu-torch210-py312-rhel9 | — | — |
| rhoai | odh-th06-cpu-torch291-py312-rhel9 | — | — |
| rhoai | odh-th06-cuda130-torch210-py312-rhel9 | — | — |
| rhoai | odh-th06-cuda130-torch291-py312-rhel9 | — | — |
| rhoai | odh-th06-rocm64-torch291-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-datascience-cpu-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-minimal-cpu-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-minimal-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-minimal-rocm-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-pytorch-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-pytorch-rocm-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-tensorflow-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-tensorflow-rocm-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-trustyai-cpu-py312-rhel9 | — | — |
CVSS provenance
nvdv4.07.5HIGHCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Jupyter JupyterLab up to 4.5.9/4.6.1 ImageViewer widget.ts cross site scripting
vuldb·2026-08-12·CVSS 7.5
CVE-2026-73415 [HIGH] Jupyter JupyterLab up to 4.5.9/4.6.1 ImageViewer widget.ts cross site scripting
A vulnerability classified as problematic was found in Jupyter JupyterLab up to 4.5.9/4.6.1. The impacted element is an unknown function of the file packages/imageviewer/src/widget.ts of the component ImageViewer. Executing a manipulation can lead to cross site scripting.
This vulnerability is tracked as CVE-2026-73415. The attack can be launched remotely. No exploit exists.
Upgrading the affected component is advised.
Red Hat
jupyterlab: JupyterLab: Arbitrary code execution via malicious image in image viewer
vendor_redhat·2026-08-12·CVSS 7.5
CVE-2026-73415 [HIGH] CWE-911 jupyterlab: JupyterLab: Arbitrary code execution via malicious image in image viewer
jupyterlab: JupyterLab: Arbitrary code execution via malicious image in image viewer
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.10 and 4.6.2, in packages/imageviewer/src/widget.ts, JupyterLab's ImageViewer uses URL.createObjectURL for a specially crafted SVG image and revokes the blob URL too early, allowing the image to retain an executable same-origin context when it is opened through the image viewer and then opened in a new browser tab. The resulting cross-site scripting can be used to execute arbitrary code on the JupyterLab server. This issue is fixed in versions 4.5.10 and 4.6.2.
A flaw was found in JupyterLab. The ImageViewer component improperly handles specially crafted SVG images
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-73415 jupyterlab: JupyterLab: Arbitrary code execution via malicious image in image viewer [epel-all]
bugzilla·2026-08-24·CVSS 7.5
CVE-2026-73415 [HIGH] CVE-2026-73415 jupyterlab: JupyterLab: Arbitrary code execution via malicious image in image viewer [epel-all]
CVE-2026-73415 jupyterlab: JupyterLab: Arbitrary code execution via malicious image in image viewer [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.10 and 4.6.2, in packages/imageviewer/src/widget.ts, JupyterLab's ImageViewer uses URL.createObjectURL for a specially crafted SVG image and revokes the blob URL too early, allowing the image to retain an executable same-origin context when it is opened through the image viewer and then opened in a new browser tab. The r
Bugzilla
CVE-2026-73415 jupyterlab: JupyterLab: Arbitrary code execution via malicious image in image viewer [fedora-all]
bugzilla·2026-08-24·CVSS 7.5
CVE-2026-73415 [HIGH] CVE-2026-73415 jupyterlab: JupyterLab: Arbitrary code execution via malicious image in image viewer [fedora-all]
CVE-2026-73415 jupyterlab: JupyterLab: Arbitrary code execution via malicious image in image viewer [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.10 and 4.6.2, in packages/imageviewer/src/widget.ts, JupyterLab's ImageViewer uses URL.createObjectURL for a specially crafted SVG image and revokes the blob URL too early, allowing the image to retain an executable same-origin context when it is opened through the image viewer and then opened in a new browser tab. The
Bugzilla
CVE-2026-73415 jupyterlab: JupyterLab: Arbitrary code execution via malicious image in image viewer
bugzilla·2026-08-12·CVSS 7.5
CVE-2026-73415 [HIGH] CVE-2026-73415 jupyterlab: JupyterLab: Arbitrary code execution via malicious image in image viewer
CVE-2026-73415 jupyterlab: JupyterLab: Arbitrary code execution via malicious image in image viewer
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.10 and 4.6.2, in packages/imageviewer/src/widget.ts, JupyterLab's ImageViewer uses URL.createObjectURL for a specially crafted SVG image and revokes the blob URL too early, allowing the image to retain an executable same-origin context when it is opened through the image viewer and then opened in a new browser tab. The resulting cross-site scripting can be used to execute arbitrary code on the JupyterLab server. This issue is fixed in versions 4.5.10 and 4.6.2.
https://github.com/jupyterlab/jupyterlab/commit/9365f020baec5221deaf11535ed554c06637c999https://github.com/jupyterlab/jupyterlab/commit/be9303f5bcd5308eaeae953c5a3c903046682c2chttps://github.com/jupyterlab/jupyterlab/commit/f1beab4a2027af4719d6edc07d52d6cf5a39a432https://github.com/jupyterlab/jupyterlab/pull/19184https://github.com/jupyterlab/jupyterlab/pull/19185https://github.com/jupyterlab/jupyterlab/pull/19186https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.10https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.2https://github.com/jupyterlab/jupyterlab/releases/tag/v4.7.0a1https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-gx64-gj6p-pc4c
2026-08-12
Published