CVE-2026-73415

[CVE catalog]

Severity

High · CVSS 8CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

Published

Jul 22, 2026, 11:14:44 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.74% · Oct 25, 2026

A flaw was found in JupyterLab. The ImageViewer component improperly handles specially crafted SVG images by revoking a blob URL too early. This allows a remote attacker to exploit a cross-site scripting (XSS) vulnerability when a malicious image is opened through the image viewer and subsequently in a new browser tab. Successful exploitation could lead to arbitrary code execution on the JupyterLab server. jupyterlab: JupyterLab: Arbitrary code execution via malicious image in image viewer This vulnerability is rated as having an Important impact because successful exploitation permits arbitrary code execution within the context of the running JupyterLab server process, potentially compromising the user's workbench environment. Within Red Hat OpenShift AI (RHOAI), containerized workbench images provide interactive JupyterLab web sessions to authenticated data scientists. While exploitation requires user interaction to open an untrusted image file in the image viewer and subsequent opening in a new tab, the resulting cross-site scripting enables complete command execution inside the container. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.