JupyterLab's image viewer contains a cross-site scripting (XSS) vulnerability when opening a specially crafted image file and then opening it in a new browser tab. This vulnerability can lead to remote code execution on the JupyterLab server. Versions prior to 4.6.2 are affected. The issue is patched in versions 4.6.2 and 4.5.10. As a workaround, disabling the image viewer plugin can mitigate the risk.