Vulnerability · Published Aug 13, 2026 · Assigned by GitHub_M
CVE-2026-73417JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)
High 8.6
In plain English
A high-severity cross-site scripting in jupyterlab from jupyterlab. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 3.3.0 until 4.5.10 and 4.6.2, JupyterLab allows notebook settings to be shared and applied through an overrides.json file using the Import button in the Settings Editor. In packages/notebook-extension/schema/tracker.json and packages/notebook-extension/src/index.ts, the sideBySideLeftMarginOverride and sideBySideRightMarginOverride settings are not properly validated before being inserted into style content, allowing a crafted settings file to contain instructions that execute as code instead of only changing display preferences. A user can import the malicious file, or an attacker with access to a shared settings location can plant an overrides.json that is applied automatically. The embedded code runs with the affected user's access and can read or modify notebooks and files and run code through the notebook server, including on a connected kernel. This issue is fixed in versions 4.5.10 and 4.6.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | jupyterlab | no fix listed | DEBIAN-CVE-2026-73417 |
| Debian:14 | jupyterlab | 4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-4 | DEBIAN-CVE-2026-73417 |
| PyPI | jupyterlab | 4.5.10, 4.6.2 | PYSEC-2026-3672 |
| PyPI | jupyterlab | 4.5.10 | GHSA-pppj-hq3g-57pj |
| PyPI | jupyterlab | 4.6.2 | GHSA-pppj-hq3g-57pj |
| Ubuntu:26.04:LTS | jupyterlab | no fix listed | UBUNTU-CVE-2026-73417 |
| Ubuntu:26.10 | jupyterlab | no fix listed | UBUNTU-CVE-2026-73417 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| jupyterlab | jupyterlab | >= 3.3.0, < 4.5.10>= 4.6.0, < 4.6.2 |
Weakness: CWE-79, CWE-116 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:L
References
- https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-pppj-hq3g-57pj x_refsource_CONFIRM
- https://github.com/jupyterlab/jupyterlab/pull/19184 x_refsource_MISC
- https://github.com/jupyterlab/jupyterlab/pull/19185 x_refsource_MISC
- https://github.com/jupyterlab/jupyterlab/pull/19186 x_refsource_MISC
- https://github.com/jupyterlab/jupyterlab/commit/9365f020baec5221deaf11535ed554c06637c999 x_refsource_MISC
- https://github.com/jupyterlab/jupyterlab/commit/be9303f5bcd5308eaeae953c5a3c903046682c2c x_refsource_MISC
- https://github.com/jupyterlab/jupyterlab/commit/f1beab4a2027af4719d6edc07d52d6cf5a39a432 x_refsource_MISC
- https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.10 x_refsource_MISC
- https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.2 x_refsource_MISC
- https://github.com/jupyterlab/jupyterlab/releases/tag/v4.7.0a1 x_refsource_MISC