GHSA-gx64-gj6p-pc4c: JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab
JupyterLab's image viewer allows for cross-site scripting (XSS) when a specially-crafted image file is opened through the image viewer and then opened in a new tab. This XSS issue can be used to cause remote code execution (RCE) on the JupyterLab server.
Impact
This vulnerability allows for arbitrary code execution.
Patches
JupyterLab v4.6.2 and v4.5.10 contain the patch.
Workarounds
Disable the image viewer plugin:
jupyter labextension disable @jupyterlab/imageviewer-extension:plugin
Confirm with:
jupyter labextension list
Details
Original advisory: https://github.com/advisories/GHSA-gx64-gj6p-pc4c
More from GitHub Security Advisories
- mediumGHSA-jr6p-8pjj-mfx6: Capsule has an incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators s…2026-07-31
- mediumGHSA-68cj-mvg9-rgm2: Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing…2026-07-31
- mediumGHSA-ff84-5f28-78qj: re2: Out-of-bounds heap read in `exec`/`test`/`match` via attacker-influenced `lastIndex`…2026-07-31
- mediumGHSA-6hxr-mr5r-9836: re2: Global `String.prototype.match` with an empty-matchable pattern never advances → inf…2026-07-31
- mediumGHSA-x83g-979r-f5fh: Sylius Mollie Plugin has unauthenticated IDOR that leaks order token and customer PII2026-07-31