CVE-2026-73415: XSS — UNKNOWN

CISO Take

JupyterLab's image viewer mishandles the lifecycle of browser blob URLs when rendering a crafted SVG, letting the image retain an executable same-origin JavaScript context if a user opens it and then reopens it in a new tab — turning what looks like a rendering bug into cross-site scripting that can pivot to full remote code execution on the JupyterLab server. This isn't remotely exploitable without user interaction, isn't in CISA's KEV catalog, has no public PoC or Nuclei template, and CISA's own SSVC decision sits at the lowest actionability tier (TRACK) — EPSS is just 0.57%, around the 55th percentile for near-term exploitation. Still, the blast radius matters: JupyterLab is a default front door for data scientists and ML engineers, often deployed multi-tenant via JupyterHub with access to training data, model artifacts, and cloud credentials, so a single crafted SVG shared in a notebook repo or support ticket could hand an attacker a foothold inside an ML environment. Patch to 4.5.10 or 4.6.2 immediately on any shared or internet-facing JupyterHub/JupyterLab deployment, and in the interim treat SVGs from untrusted sources as executable content rather than images. Watch for unexpected kernel/contents-API calls immediately following image-viewer activity as a rough detection heuristic until patched.

Sources:NVDGitHub AdvisoryEPSSCISA KEVATLAS

What is the risk?

MEDIUM risk. The flaw itself (CWE-79) is a same-origin bypass that requires user interaction — opening a crafted SVG in the image viewer, then reopening it in a new tab — with no unauthenticated network-exploitable path, no public exploit code, no Nuclei template, and a CISA SSVC decision of TRACK, its lowest tier. EPSS (0.57%, ~55th percentile) suggests exploitation is plausible but not currently observed in the wild. What elevates this above a routine low finding is impact: successful exploitation escalates client-side XSS into server-side code execution on the JupyterLab backend, effectively full compromise of the notebook session and everything it can reach (kernel, filesystem, credentials, connected data sources). Multi-tenant JupyterHub deployments used for collaborative ML development amplify exposure, since one user opening a malicious file affects a shared host.

How does the attack unfold?

Delivery

Attacker crafts a malicious SVG exploiting the blob URL revocation timing and delivers it via a shared notebook, dataset, or support ticket.

AML.T0078

User Execution

Victim opens the SVG in JupyterLab's ImageViewer and reopens it in a new browser tab, triggering the retained blob: URL context.

AML.T0011.003

Same-Origin Script Execution

Attacker-controlled JavaScript executes in the same origin as the authenticated JupyterLab session, bypassing normal cross-origin restrictions.

AML.T0107

Impact: Server-Side RCE

The script invokes JupyterLab's kernel/contents API with the victim's session to execute arbitrary code on the JupyterLab server, compromising the notebook environment.

Delivery

Attacker crafts a malicious SVG exploiting the blob URL revocation timing and delivers it via a shared notebook, dataset, or support ticket.

AML.T0078

User Execution

Victim opens the SVG in JupyterLab's ImageViewer and reopens it in a new browser tab, triggering the retained blob: URL context.

AML.T0011.003

Same-Origin Script Execution

Attacker-controlled JavaScript executes in the same origin as the authenticated JupyterLab session, bypassing normal cross-origin restrictions.

AML.T0107

Impact: Server-Side RCE

The script invokes JupyterLab's kernel/contents API with the victim's session to execute arbitrary code on the JupyterLab server, compromising the notebook environment.

How severe is it?

CVSS 3.1

N/A

EPSS

0.7%

chance of exploitation in 30 days

Higher than 55% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What should I do?

1 step

Patch JupyterLab to 4.5.10 or 4.6.2 across all standalone and JupyterHub-hosted instances. Until patched, restrict or disable the built-in Image Viewer for SVG files where feasible, and train users not to open image files of unknown provenance directly in JupyterLab, especially in a new browser tab. For shared JupyterHub deployments, enforce a strict Content-Security-Policy and isolate single-user servers (containerized, no shared cookie/session scope) to limit blast radius if one user is compromised. For detection, monitor for anomalous kernel/contents-API calls immediately following image-file access, and audit access logs for blob: URL activity correlated with new-tab navigation from the image viewer.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionSocial EngineeringFrameworkAML.T0011.003- Malicious Link AML.T0078- Drive-by Compromise AML.T0107- Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

Clause 8.1-Operational planning and control

NIST AI RMF

MEASURE 2.7-AI system security and resilience are evaluated

Frequently Asked Questions

What is CVE-2026-73415?

JupyterLab's image viewer mishandles the lifecycle of browser blob URLs when rendering a crafted SVG, letting the image retain an executable same-origin JavaScript context if a user opens it and then reopens it in a new tab — turning what looks like a rendering bug into cross-site scripting that can pivot to full remote code execution on the JupyterLab server. This isn't remotely exploitable without user interaction, isn't in CISA's KEV catalog, has no public PoC or Nuclei template, and CISA's own SSVC decision sits at the lowest actionability tier (TRACK) — EPSS is just 0.57%, around the 55th percentile for near-term exploitation. Still, the blast radius matters: JupyterLab is a default front door for data scientists and ML engineers, often deployed multi-tenant via JupyterHub with access to training data, model artifacts, and cloud credentials, so a single crafted SVG shared in a notebook repo or support ticket could hand an attacker a foothold inside an ML environment. Patch to 4.5.10 or 4.6.2 immediately on any shared or internet-facing JupyterHub/JupyterLab deployment, and in the interim treat SVGs from untrusted sources as executable content rather than images. Watch for unexpected kernel/contents-API calls immediately following image-viewer activity as a rough detection heuristic until patched.

Is CVE-2026-73415 actively exploited?

No confirmed active exploitation of CVE-2026-73415 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-73415?

Patch JupyterLab to 4.5.10 or 4.6.2 across all standalone and JupyterHub-hosted instances. Until patched, restrict or disable the built-in Image Viewer for SVG files where feasible, and train users not to open image files of unknown provenance directly in JupyterLab, especially in a new browser tab. For shared JupyterHub deployments, enforce a strict Content-Security-Policy and isolate single-user servers (containerized, no shared cookie/session scope) to limit blast radius if one user is compromised. For detection, monitor for anomalous kernel/contents-API calls immediately following image-file access, and audit access logs for blob: URL activity correlated with new-tab navigation from the image viewer.

What systems are affected by CVE-2026-73415?

This vulnerability affects the following AI/ML architecture patterns: notebook-based ML development environments, multi-tenant JupyterHub deployments, data science / ML collaboration platforms, MLOps experimentation pipelines.

What is the CVSS score for CVE-2026-73415?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

notebook-based ML development environmentsmulti-tenant JupyterHub deploymentsdata science / ML collaboration platformsMLOps experimentation pipelines

MITRE ATLAS Techniques

AML.T0011.003Malicious Link

AML.T0078Drive-by Compromise

AML.T0107Exploitation for Defense Evasion

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Clause 8.1

NIST AI RMF: MEASURE 2.7

What are the technical details?

Original Advisory

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.10 and 4.6.2, in packages/imageviewer/src/widget.ts, JupyterLab's ImageViewer uses URL.createObjectURL for a specially crafted SVG image and revokes the blob URL too early, allowing the image to retain an executable same-origin context when it is opened through the image viewer and then opened in a new browser tab. The resulting cross-site scripting can be used to execute arbitrary code on the JupyterLab server. This issue is fixed in versions 4.5.10 and 4.6.2.

Exploitation Scenario

An attacker shares a specially crafted SVG — embedded in a public dataset, a shared research notebook repository, or attached to a support ticket — knowing the target uses JupyterLab. The victim opens it in JupyterLab's built-in ImageViewer and then opens it in a new browser tab, a common workflow for inspecting images at full size. Because the blob: URL backing the image was revoked too early, the new tab retains an executable same-origin JavaScript context, letting attacker-controlled script run with the same origin/session as the JupyterLab server. From there the script calls JupyterLab's REST/kernel APIs using the victim's authenticated session to execute arbitrary code on the server — reading notebooks, exfiltrating credentials, or pivoting further into the ML environment.

Weaknesses (CWE)

CWE-79Improper Neutralization of Input During Web Page Generation CWE-79Improper Neutralization of Input During Web Page Generation

CWE-79 — Improper Neutralization of Input During Web Page Generation: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.
[Implementation, Architecture and Design] Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies. For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters. Parts of the same output document may require different encodings, which will vary depending on whether the output is in the: etc. Note that HTML Entity Encoding is only appropriate for the HTML body. Consult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed. HTML body Element attributes (such as src="XYZ") URIs JavaScript sections Casca

Source: MITRE CWE corpus.