CVE-2026-73417 jupyterlab CVE debrief

Who should care

Users of JupyterLab, particularly those who use shared settings or import settings files from untrusted sources, should assess their exposure and take steps to mitigate the vulnerability. This includes reviewing and validating overrides.json files before importing them, restricting access to shared settings locations, and upgrading to JupyterLab version 4.5.10 or 4.6.2 or later.

Why it matters

This vulnerability allows for code execution through a malicious overrides.json file, potentially leading to unauthorized access and modification of notebooks and files.

• Code execution with user access
• Potential for notebook and file modification
• Risk of unauthorized access to connected kernels

Technical summary

The vulnerability in JupyterLab allows for code execution through a malicious overrides.json file. The issue is caused by improper validation of sideBySideLeftMarginOverride and sideBySideRightMarginOverride settings in the tracker.json and index.ts files. This allows a crafted settings file to contain instructions that execute as code instead of only changing display preferences. A user can import the malicious file, or an attacker with access to a shared settings location can plant an overrides.json that is applied automatically.

Defensive priority

High

Recommended defensive actions

• Upgrade to JupyterLab version 4.5.10 or 4.6.2 or later
• Review and validate overrides.json files before importing them
• Restrict access to shared settings locations
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. The vulnerability allows for code execution with user access, potential for notebook and file modification, and risk of unauthorized access to connected kernels. Users should review and validate overrides.json files before importing them and restrict access to shared settings locations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.