Homepage

CVE-2026-73415 Affecting jupyterlab package, versions <4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-4

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.74% (53rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIANUNSTABLE-JUPYTERLAB-18767482
  • published14 Aug 2026
  • disclosed12 Aug 2026
Report a new vulnerability Found a mistake?

Introduced: 12 Aug 2026

CVE-2026-73415  (opens in a new tab)

How to fix?

Upgrade Debian:unstable jupyterlab to version 4.4.10+ds1+3.1.0+0.16.6+~cs1.4.4-4 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream jupyterlab package and not the jupyterlab package as distributed by Debian. See How to fix? for Debian:unstable relevant fixed versions and status.

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.10 and 4.6.2, in packages/imageviewer/src/widget.ts, JupyterLab's ImageViewer uses URL.createObjectURL for a specially crafted SVG image and revokes the blob URL too early, allowing the image to retain an executable same-origin context when it is opened through the image viewer and then opened in a new browser tab. The resulting cross-site scripting can be used to execute arbitrary code on the JupyterLab server. This issue is fixed in versions 4.5.10 and 4.6.2.