GHSA-GX64-GJ6P-PC4C: Stored Cross-Site Scripting in JupyterLab Image Viewer

Vulnerability ID: GHSA-GX64-GJ6P-PC4C

CVSS Score: 8.2

Published: 2026-07-22

A stored Cross-Site Scripting (XSS) vulnerability exists in JupyterLab's Image Viewer component when processing Scalable Vector Graphics (SVG) images. Due to the lingering lifecycle of generated object URLs and the inheritance of the application origin by client-side Blobs, an attacker can execute arbitrary JavaScript within the victim's active session. This execution occurs when a user views an SVG file in the JupyterLab image viewer, right-clicks the image, and selects 'Open image in new tab'.

TL;DR

Stored XSS in JupyterLab's image viewer allows arbitrary JavaScript execution and host takeover when a user opens a malicious SVG image in a new browser tab.

⚠️ Exploit Status: POC

Technical Details

• 
  CWE ID: CWE-79


• 
  Attack Vector: Network (AV:N)


• 
  CVSS v3.1: 8.2 (High)


• 
  Exploit Status: Proof-of-Concept


• 
  Impact: Stored XSS / Remote Command Execution


• 
  CISA KEV Status: Not Listed

Affected Systems

• JupyterLab Server deployments


• 
  JupyterLab: < 4.5.10 (Fixed in: 4.5.10)


• 
  JupyterLab: >= 4.6.0, < 4.6.2 (Fixed in: 4.6.2)

Code Analysis

Commit:

Revoke image object URLs in 4.6.x branch immediately on load/error events to prevent lifetime-based XSS attacks.

Exploit Details

Read the full report for GHSA-GX64-GJ6P-PC4C on our website for more details including interactive diagrams and full exploit analysis.