CVE-2026-73417

[CVE catalog]

Severity

High · CVSS 8.6CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Published

Jul 22, 2026, 11:16:18 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.75% · Oct 25, 2026

A flaw was found in JupyterLab. Improper validation of `sideBySideLeftMarginOverride` and `sideBySideRightMarginOverride` settings within the `overrides.json` file allows for cross-site scripting (XSS). An attacker can exploit this by convincing a user to import a specially crafted settings file, or by placing such a file in a shared settings location. Successful exploitation can lead to arbitrary code execution, enabling the attacker to read or modify notebooks and files, and run code through the notebook server. jupyterlab: JupyterLab: Cross-site scripting (XSS) allows arbitrary code execution This Important cross-site scripting (XSS) flaw in JupyterLab allows arbitrary code execution when processing a specially crafted overrides.json file. An attacker could either plant a malicious settings file in a shared location, leading to automatic execution, or trick a user into importing one. This grants the attacker the ability to read/modify user files and execute code with the user's permissions, impacting Red Hat OpenShift AI and Migration Toolkit for Applications deployments. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.