Executive brief
JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab
Affected products
- PyPI jupyterlab
Junglewise Threat Intelligence
CVE-2026-73415: PYSEC-2026-3671 - JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab
CVE-2026-73415 · Severity: medium · CVSS 4 · Published 2026-08-19
Technologies: jupyterlab (PyPI). Vendors: PyPI.
Related threats
- JupyterLab arbitrary code execution via malicious overrides.json
- JupyterLab extension blocklist bypass via package name variant
- PYSEC-2026-2682 - Jupyter Notebook Vulnerable to Authentication Token Theft via CommandLinker XSS
- PYSEC-2026-2536 - HTML injection in Jupyter Notebook and JupyterLab leading to DOM Clobbering
- PYSEC-2026-2534 - JupyterLab vulnerable to potential authentication and CSRF tokens leak