The vulnerability in JupyterLab's image viewer allows an attacker to execute cross-site scripting (CWE-79) by crafting a malicious image file that, when opened in the image viewer and then in a new browser tab, can execute arbitrary code on the server. This can lead to remote code execution (RCE) on the JupyterLab server. The issue affects versions prior to 4.6.2 (specifically >=4.6.0 <4.6.2) and versions before 4.5.10. The vulnerability has a high severity rating and is documented under GHSA-gx64-gj6p-pc4c.

Successful exploitation allows arbitrary code execution on the JupyterLab server, which could compromise the server's integrity and confidentiality. This elevates the risk of full system compromise if the server is exposed to untrusted users.

Apply the official patches by upgrading JupyterLab to version 4.6.2 or later, or to 4.5.10 or later. Alternatively, disable the image viewer plugin using the command 'jupyter labextension disable @jupyterlab/imageviewer-extension:plugin' to mitigate the vulnerability until patching is possible.