CVE-2026-73415 jupyterlab CVE debrief

Who should care

Defenders responsible for JupyterLab installations should assess exposure and apply patches or mitigations as available to prevent arbitrary code execution on the JupyterLab server. This includes verifying the version of JupyterLab in use, reviewing system configurations, and ensuring that appropriate security controls are in place to monitor and mitigate potential threats. Additionally, security teams should review the vulnerability's operational impacts,

Why it matters

Defenders should prioritize verifying exposure of JupyterLab installations to this vulnerability and apply patches or mitigations as available to prevent arbitrary code execution on the JupyterLab server.

• Arbitrary code execution on the JupyterLab server
• Cross-site scripting in ImageViewer
• Potential for malicious code execution in JupyterLab environment

Technical summary

The vulnerability exists in packages/imageviewer/src/widget.ts, where JupyterLab's ImageViewer uses URL.createObjectURL for a specially crafted SVG image and revokes the blob URL too early, allowing the image to retain an executable same-origin context. This can lead to cross-site scripting and arbitrary code execution on the JupyterLab server when the image is opened through the image viewer and then opened in a new browser tab. The issue is fixed in versions 4.5.10 and 4.6.2, and defenders should prioritize verifying exposure of JupyterLab installations to this vulnerability.

Defensive priority

Defenders should prioritize verifying exposure of JupyterLab installations to this vulnerability and apply patches or mitigations as available.

Recommended defensive actions

• Verify exposure of JupyterLab installations to this vulnerability
• Apply patches or mitigations as available
• Monitor for suspicious activity related to ImageViewer
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by JupyterLab's ImageViewer using URL.createObjectURL for a specially crafted SVG image and revoking the blob URL too early. This allows the image to retain an executable same-origin context when it is opened through the image viewer and then opened in a new browser tab, potentially leading to cross-site scripting and arbitrary code execution on the JupyterLab server. The issue is fixed in versions 4.5.10 and 4.6.2. Evidence is limited to public CVE details and vendor advisories, which indicate that the fix

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.