GHSA-gx64-gj6p-pc4c: JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab
(updated )
JupyterLab’s image viewer allows for cross-site scripting (XSS) when a specially-crafted image file is opened through the image viewer and then opened in a new tab. This XSS issue can be used to cause remote code execution (RCE) on the JupyterLab server.
References
- github.com/advisories/GHSA-gx64-gj6p-pc4c
- github.com/jupyterlab/jupyterlab/commit/be9303f5bcd5308eaeae953c5a3c903046682c2c
- github.com/jupyterlab/jupyterlab/commit/f1beab4a2027af4719d6edc07d52d6cf5a39a432
- github.com/jupyterlab/jupyterlab/pull/19184
- github.com/jupyterlab/jupyterlab/pull/19185
- github.com/jupyterlab/jupyterlab/pull/19186
- github.com/jupyterlab/jupyterlab/releases/tag/v4.5.10
- github.com/jupyterlab/jupyterlab/releases/tag/v4.6.2
- github.com/jupyterlab/jupyterlab/security/advisories/GHSA-gx64-gj6p-pc4c
- nvd.nist.gov/vuln/detail/CVE-2026-73415
Code Behaviors & Features
Detect and mitigate GHSA-gx64-gj6p-pc4c with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →