Threats tagged 'brew-jupyterlab-cve-2026-44899'

JupyterLab's Mistune Image directive plugin improperly validates the width and height options using a regex that only anchors at the start of the string. This allows an attacker to inject arbitrary CSS properties into the style attribute of an image element by providing a crafted width value that begins with digits but includes additional CSS declarations. This vulnerability can be exploited to create full-page overlays that visually cover the browser viewport, enabling phishing and UI redressing attacks.