GHSA-gx64-gj6p-pc4c

Summary

JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab

Severity

high

CWE

CWE-79

Published

2026-07-22

Updated

2026-07-22

Advisory details

JupyterLab's image viewer allows for cross-site scripting (XSS) when a specially-crafted image file is opened through the image viewer and then opened in a new tab. This XSS issue can be used to cause remote code execution (RCE) on the JupyterLab server.

Impact

This vulnerability allows for arbitrary code execution.

Patches

JupyterLab v4.6.2 and v4.5.10 contain the patch.

Workarounds

Disable the image viewer plugin:

jupyter labextension disable @jupyterlab/imageviewer-extension:plugin

Confirm with:

jupyter labextension list

References

• https://github.com/advisories/GHSA-gx64-gj6p-pc4c
• https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-gx64-gj6p-pc4c
• https://github.com/jupyterlab/jupyterlab/pull/19184
• https://github.com/jupyterlab/jupyterlab/pull/19185
• https://github.com/jupyterlab/jupyterlab/pull/19186
• https://github.com/jupyterlab/jupyterlab/commit/be9303f5bcd5308eaeae953c5a3c903046682c2c
• https://github.com/jupyterlab/jupyterlab/commit/f1beab4a2027af4719d6edc07d52d6cf5a39a432
• https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.10

Related advisories

• CVE-2026-102831 — high · PyPI/jupyterlab
• GHSA-pppj-hq3g-57pj — high · PyPI/jupyterlab
• CVE-2026-102830 — medium · PyPI/jupyterlab
• CVE-2026-102832 — medium · PyPI/jupyterlab
• CVE-2026-102904 — medium · PyPI/jupyterlab
• GHSA-89vp-jrxv-24w8 — medium · PyPI/jupyterlab
• GHSA-h5v5-8746-g7mm — medium · PyPI/jupyterlab
• GHSA-cg2g-xh64-v4q7 — critical · npm/dompurify

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity