7.5

CVE-2026-73415: jupyterlab Cross-site Scripting

CVSS: 7.5v4.0HighAwaiting analysis
AliasesGHSA-gx64-gj6p-pc4cBIT-jupyterlab-2026-73415PYSEC-2026-3671
Published 12-08-2026Last modified 12-08-2026
Open JSON

Vulnerability summary

CVE-2026-73415 is a high (CVSS 7.5) Cross-site Scripting vulnerability in jupyterlab. EPSS estimates a 0.74% chance of exploitation in the next 30 days, higher than 53.7% of scored vulnerabilities.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v4.0 (CVE.org)
EPSS score
0.74%
0%100%
Low · +0.16 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 2
OPENSUSE-SU-2026:11634-1CGA-M2WG-94XR-PVR5

Timeline

  1. 12-08-2026
    PublishedVulnerability first disclosed.
  2. 12-08-2026
    Last modifiedVulnerability information updated.

Description

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.10 and 4.6.2, in packages/imageviewer/src/widget.ts, JupyterLab's ImageViewer uses URL.createObjectURL for a specially crafted SVG image and revokes the blob URL too early, allowing the image to retain an executable same-origin context when it is opened through the image viewer and then opened in a new browser tab. The resulting cross-site scripting can be used to execute arbitrary code on the JupyterLab server. This issue is fixed in versions 4.5.10 and 4.6.2.

CVSS metrics

6 scores · 6 sources · 1 version

EPSS trend

Probability

0.74%

Chance of exploitation in the next 30 days

Percentile

54%

Versus all other CVEs

30-day change

+0.16 pp

From 0.57% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.74%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard1 product
  • tensorflow-cpu-jupyter< 2.21.0-r9
Debian1 product
  • jupyterlabAll versions (No fix recorded) | < 4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-4
Jupyterlab1 product
PyPI1 product
  • jupyterlab< 4.5.10 | ≥ 4.6.0, < 4.6.2
Ubuntu1 product
  • jupyterlabAll versions (No fix recorded)

5 vendors · 5 products

References

18 links
Show all 18 references