JupyterLab EUVD-2026-57535

Three conditions must simultaneously hold: (1) JupyterLab version must be <= 4.5.9 or 4.6.0-4.6.1; (2) the ImageViewer plugin (@jupyterlab/imageviewer-extension:plugin) must be enabled - it is enabled by default in all affected versions, so no non-default configuration is required on the server side; and (3) the victim must perform two active steps: first open the malicious SVG through the ImageViewer, then manually open it in a new browser tab. The critical exploitation limit is this mandatory two-step user interaction - simply viewing the SVG in the ImageViewer panel is insufficient to trigger the XSS. The attacker must first deliver the SVG file to a location accessible in the victim's JupyterLab session (shared filesystem in JupyterHub, uploaded artifact, or notebook-attached file). CVSS PR:N confirms no server-side authentication is required to trigger the vulnerability once the file is in the victim's accessible workspace; however, delivering the file to a targeted user's workspace may itself require some form of access in isolated deployments.

The CVSS 4.0 score of 7.5 (AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L) accurately captures the two-part tension of this vulnerability: the attack complexity is high because exploitation requires the victim to perform two distinct actions (open the SVG in ImageViewer, then explicitly open it in a new browser tab), yet the downstream impact is severe - VC:H and VI:H reflect full confidentiality and integrity compromise of the JupyterLab server. PR:N confirms no authentication is required to deliver and trigger the payload once a file is in scope. The UI:A (active interaction) flag is the principal limiting factor and distinguishes this from a one-click exploit. In multi-user JupyterHub deployments where datasets and notebooks are shared, social engineering a victim into this two-step sequence is realistic: inspecting an image in a new tab is a natural workflow. For isolated single-user local deployments, risk is lower since an attacker must first place a malicious SVG on the local filesystem. No EPSS score was provided in the input data; no KEV listing exists; no public PoC has been identified. The CVSS 4.0 SC:N/SI:N/SA:N metrics may understate risk in networked deployments where the JupyterLab server has access to downstream systems, but this is context-dependent and cannot be confirmed from available data.

An attacker operating in a shared JupyterHub environment uploads a specially crafted SVG file to a shared dataset directory or sends it via a notebook attachment. A data scientist opens the file through JupyterLab's ImageViewer (the default handler for image files) and, wanting a closer look, right-clicks and opens it in a new browser tab - a routine workflow step. The SVG's embedded JavaScript executes in the JupyterLab server's same-origin context and silently posts a request to the kernel API to run an OS command, exfiltrating credentials or establishing a reverse shell on the server. No public exploit code has been identified at time of analysis.