jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.10 and 4.6.2, in packages/imageviewer/src/widget.ts, JupyterLab's ImageViewer uses URL.createObjectURL for a specially crafted SVG image and revokes the blob URL too early, allowing the image to retain an executable same-origin context when it is opened through the image viewer and then opened in a new browser tab. The resulting cross-site scripting can be used to execute arbitrary code on the JupyterLab server. This issue is fixed in versions 4.5.10 and 4.6.2.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter     Notebook Architecture. Prior to 4.5.10 and 4.6.2, in packages/imageviewer/src/widget.ts, JupyterLab's     ImageViewer uses URL.createObjectURL for a specially crafted SVG image and revokes the blob URL too early,     allowing the image to retain an executable same-origin context when it is opened through the image viewer     and then opened in a new browser tab. The resulting cross-site scripting can be used to execute arbitrary     code on the JupyterLab server. This issue is fixed in versions 4.5.10 and 4.6.2. (CVE-2026-73415)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter
    Notebook Architecture. Prior to 4.5.10 and 4.6.2, in packages/imageviewer/src/widget.ts, JupyterLab's
    ImageViewer uses URL.createObjectURL for a specially crafted SVG image and revokes the blob URL too early,
    allowing the image to retain an executable same-origin context when it is opened through the image viewer
    and then opened in a new browser tab. The resulting cross-site scripting can be used to execute arbitrary
    code on the JupyterLab server. This issue is fixed in versions 4.5.10 and 4.6.2. (CVE-2026-73415)

ID	Name	Product	Family	Type	Severity
335381	Linux Distros Unpatched Vulnerability : CVE-2026-73415	Nessus	Misc.	Local	high
445131	SCA: security update for jupyterlab (GHSA-gx64-gj6p-pc4c)	Tenable Cloud Security	SCA Checks	Local	high
445131	SCA: security update for jupyterlab (GHSA-gx64-gj6p-pc4c)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-73415

high

Tenable Plugins

high

high

high