GHSA-GX64-GJ6P-PC4C: GHSA-GX64-GJ6P-PC4C: Stored Cross-Site Scripting in JupyterLab Image Viewer

GHSA-GX64-GJ6P-PC4C: Stored Cross-Site Scripting in JupyterLab Image Viewer

Vulnerability ID: GHSA-GX64-GJ6P-PC4C

CVSS Score: 8.2

A stored Cross-Site Scripting (XSS) vulnerability exists in JupyterLab's Image Viewer component when processing Scalable Vector Graphics (SVG) images. Due to the lingering lifecycle of generated object URLs and the inheritance of the application origin by client-side Blobs, an attacker can execute arbitrary JavaScript within the victim's active session. This execution occurs when a user views an SVG file in the JupyterLab image viewer, right-clicks the image, and selects 'Open image in new tab'.

TL;DR

GHSA-GX64-GJ6P-PC4C: GHSA-GX64-GJ6P-PC4C: Stored Cross-Site Scripting in JupyterLab Image Viewer

Other newsrooms on this story

Related reading

From POC to Patch: Analyzing the Contest Gallery 28.1.4 Vulnerability

Ghost CMS SQL injection flaw exploited in large-scale ClickFix campaign

CISA Warns of Actively Exploited Joomla JCE Flaw Allowing PHP Code Execution

Organizations Warned of Exploited Joomla Extension Vulnerabilities

Critical Cursor AI Code Editor Flaws Could Lead to OS-Level Remote Code…

Ghost CMS CVE-2026-26980 Exploited to Hijack 700+ Sites for ClickFix Attacks