Most recent entries from all

BIT-jupyterlab-2026-73415 — jupyterlab: Image viewer in JupyterLab allows XSS when opening malicious image in new browser tab

Affected: Bitnami: jupyterlab

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.10 and 4.6.2, in packages/imageviewer/src/widget.ts, JupyterLab's ImageViewer uses URL.createObjectURL for a specially crafted SVG image and revokes the blob URL too early, allowing the image to retain an executable same-origin context when it is opened through the image viewer and then opened in a new browser tab. The resulting cross-site scripting can be used to execute arbitrary code on the JupyterLab server. This issue is fixed in versions 4.5.10 and 4.6.2.

BREW-jupyterlab-CVE-2026-73415 — JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab

Affected: Homebrew: jupyterlab

JupyterLab's image viewer allows for cross-site scripting (XSS) when a specially-crafted image file is opened through the image viewer and then opened in a new tab. This XSS issue can be used to cause remote code execution (RCE) on the JupyterLab server.

### Impact

This vulnerability allows for arbitrary code execution.

### Patches

JupyterLab [`v4.6.2`](https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.2) and [`v4.5.10`](https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.10) contain the patch.

### Workarounds

Disable the image viewer plugin:

``` jupyter labextension disable @jupyterlab/imageviewer-extension:plugin ```

Confirm with:

``` jupyter labextension list ```

EUVD-2026-351745

fkie_cve-2026-73415

GHSA-gx64-gj6p-pc4c — JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab

Affected: PyPI: jupyterlab

### Impact

This vulnerability allows for arbitrary code execution.

### Patches

JupyterLab [`v4.6.2`](https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.2) and [`v4.5.10`](https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.10) contain the patch.

### Workarounds

Disable the image viewer plugin:

``` jupyter labextension disable @jupyterlab/imageviewer-extension:plugin ```

Confirm with:

``` jupyter labextension list ```

openSUSE-SU-2026:11634-1 — jupyter-jupyterlab-4.5.10-1.1 on GA media

jupyter-jupyterlab-4.5.10-1.1 on GA media

PYSEC-2026-3671 — JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab

Affected: PyPI: jupyterlab

### Impact

This vulnerability allows for arbitrary code execution.

### Patches

JupyterLab [`v4.6.2`](https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.2) and [`v4.5.10`](https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.10) contain the patch.

### Workarounds

Disable the image viewer plugin:

``` jupyter labextension disable @jupyterlab/imageviewer-extension:plugin ```

Confirm with:

``` jupyter labextension list ```

RHSA-2026:65126 — Red Hat Security Advisory: RHOAI 2.25.11 - Red Hat OpenShift AI

crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method path-to-regexp: path-to-regexp: Denial of Service via crafted regular expressions undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing org.eclipse.parsson/parsson: Eclipse Parsson: Denial of Service via uncontrolled resource consumption in JSON parsing undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames nltk: NLTK: Information disclosure via path traversal vulnerability brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity vertx-core: Eclipse Vert.x: Information disclosure via improper handling of HTTP 30x redirects guardrails-detectors: guardrails-detectors: Unauthenticated Regular-Expression Denial of Service (ReDoS) via detector_params.regex guardrails-detectors: guardrails-detectors: SSRF and local file read via user-supplied XML Schema (xml-with-schema:) trustyai-service-operator: trustyai-service-operator: TAS internal Service bypasses kube-rbac-proxy, exposing unauthenticated Quarkus API cluster-wide odh-dashboard: odh-dashboard: Backend port 8080 trusts x-forwarded-access-token without origin validation data-science-pipelines-operator: DSPO: Operator ClusterRole grants…

UBUNTU-CVE-2026-73415

Affected: Ubuntu:26.04:LTS: jupyterlab