CVE-2026-73415 jupyterlab: Image viewer in JupyterLab allows XSS when opening malicious image in new browser tab
Attackers can execute arbitrary code on the JupyterLab server by tricking users into opening a malicious SVG image in a new tab.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-73415?
CVE-2026-73415 is a high-severity cross-site scripting vulnerability in jupyterlab, published on 12 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.10 and 4.6.2, in packages/imageviewer/src/widget.ts, JupyterLab's ImageViewer uses URL.createObjectURL for a specially crafted SVG image and revokes the blob URL too early, allowing the image to retain an executable same-origin context when it is opened through the image viewer and then opened in a new browser tab. The resulting cross-site scripting can be used to execute arbitrary code on the JupyterLab server. This issue is fixed in versions 4.5.10 and 4.6.2.
Weakness: CWE-79
Which versions are affected by CVE-2026-73415?
6 open source packages ship an affected version, including jupyterlab.
| Package | Affected | Fixed in |
|---|---|---|
jupyterlab Bitnami | All versions | 4.5.10, 4.6.2 |
jupyterlab PyPI | All versions | 4.5.10, 4.6.2 |
jupyterlab PyPI | All versions | 4.5.10 |
jupyterlab PyPI | All versions | 4.5.10 |
jupyterlab PyPI | From 4.6.0 | 4.6.2 |
jupyterlab PyPI | From 4.6.0 | 4.6.2 |
How do I fix CVE-2026-73415?
Upgrade jupyterlab to a fixed version for your release line: 4.5.10 or 4.6.2.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-73415 being exploited?
There is no known exploitation of CVE-2026-73415 in the wild and no public exploit code.
Sources
Also known as BIT-jupyterlab-2026-73415, CLEANSTART-2026-SP63769, DEBIAN-CVE-2026-73415, GHSA-gx64-gj6p-pc4c, PYSEC-2026-3671, UBUNTU-CVE-2026-73415.