JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab
JupyterLab versions prior to 4.5.10 and 4.6.2 contain a cross-site scripting (XSS) vulnerability in the ImageViewer component. The issue arises because the ImageViewer uses URL.createObjectURL for specially crafted SVG images and revokes the blob URL too early. This allows the image to retain an executable same-origin context when opened in the image viewer and then in a new browser tab. This vulnerability can lead to arbitrary code execution on the JupyterLab server. The vulnerability is fixed in versions 4.5.10 and 4.6.2.
AI Analysis
Technical Summary
JupyterLab's ImageViewer component in versions prior to 4.5.10 and 4.6.2 improperly revokes blob URLs created via URL.createObjectURL for specially crafted SVG images. This premature revocation allows the SVG image to maintain an executable same-origin context when opened in a new browser tab, resulting in a cross-site scripting (XSS) vulnerability. Exploiting this flaw could enable an attacker to execute arbitrary code on the JupyterLab server. The issue is tracked as CWE-79 and has been assigned a high severity rating. Official fixes are available in versions 4.5.10 and 4.6.2.
Potential Impact
Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the JupyterLab server through a cross-site scripting attack. This can compromise the server's integrity and potentially lead to further unauthorized actions within the affected environment.
Mitigation Recommendations
Upgrade JupyterLab to version 4.5.10 or later, or 4.6.2 or later, where this vulnerability has been fixed. Applying these official patches will remediate the issue. No additional mitigation steps are indicated by the vendor advisory.
JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab
Description
JupyterLab versions prior to 4.5.10 and 4.6.2 contain a cross-site scripting (XSS) vulnerability in the ImageViewer component. The issue arises because the ImageViewer uses URL.createObjectURL for specially crafted SVG images and revokes the blob URL too early. This allows the image to retain an executable same-origin context when opened in the image viewer and then in a new browser tab. This vulnerability can lead to arbitrary code execution on the JupyterLab server. The vulnerability is fixed in versions 4.5.10 and 4.6.2.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
JupyterLab's ImageViewer component in versions prior to 4.5.10 and 4.6.2 improperly revokes blob URLs created via URL.createObjectURL for specially crafted SVG images. This premature revocation allows the SVG image to maintain an executable same-origin context when opened in a new browser tab, resulting in a cross-site scripting (XSS) vulnerability. Exploiting this flaw could enable an attacker to execute arbitrary code on the JupyterLab server. The issue is tracked as CWE-79 and has been assigned a high severity rating. Official fixes are available in versions 4.5.10 and 4.6.2.
Potential Impact
Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the JupyterLab server through a cross-site scripting attack. This can compromise the server's integrity and potentially lead to further unauthorized actions within the affected environment.
Mitigation Recommendations
Upgrade JupyterLab to version 4.5.10 or later, or 4.6.2 or later, where this vulnerability has been fixed. Applying these official patches will remediate the issue. No additional mitigation steps are indicated by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-gx64-gj6p-pc4c
- Osv Schema Version
- 1.4.0
- Aliases
- []
- Ecosystems
- ["PyPI"]
- Database Specific Severity
- HIGH
- Cvss Version
- 4.0
Threat ID: 6a616bcb9c2644c7f80dbc37
Added to database: 07/23/2026, 01:18:03 UTC
Last enriched: 08/18/2026, 13:41:31 UTC
Last updated: 09/05/2026, 09:06:00 UTC
Views: 77
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.