VDB
EN
—

PYSEC-2026-3671

JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab

빠른 조치

PYSEC-2026-3671 — jupyterlab: 아래 명령으로 수정 버전으로 올리세요. 

pip install --upgrade 'jupyterlab>=4.5.10'

상세

JupyterLab's image viewer allows for cross-site scripting (XSS) when a specially-crafted image file is opened through the image viewer and then opened in a new tab. This XSS issue can be used to cause remote code execution (RCE) on the JupyterLab server.

### Impact

This vulnerability allows for arbitrary code execution.

### Patches

JupyterLab [`v4.6.2`](https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.2) and [`v4.5.10`](https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.10) contain the patch.

### Workarounds

Disable the image viewer plugin:

``` jupyter labextension disable @jupyterlab/imageviewer-extension:plugin ```

Confirm with:

``` jupyter labextension list ```

이 버전이 영향받나요?

사용 중인 패키지 버전을 입력하면 즉시 평가합니다.

영향 패키지

PyPI / jupyterlab
최초 영향 버전: 0 수정 버전: 4.5.10
수정 pip install --upgrade 'jupyterlab>=4.5.10'

참고