PT-2026-71918 · Project Jupyter · Jupyterlab
CVE-2026-73417
·
Published
2026-07-22
·
Updated
2026-08-28
CVSS v4.0
8.6
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
JupyterLab versions 3.3.0 through 4.5.9
JupyterLab versions 4.6.0 through 4.6.1
Description
JupyterLab allows notebook settings to be shared and applied via an
overrides.json file through the Settings Editor Import button. The sideBySideLeftMarginOverride and sideBySideRightMarginOverride settings in packages/notebook-extension/schema/tracker.json and packages/notebook-extension/src/index.ts are not properly validated before being inserted into style content. This allows a crafted settings file to execute arbitrary code instead of only modifying display preferences. The code executes with the permissions of the affected user, enabling the reading or modification of notebooks and files, and the execution of code through the notebook server and connected kernels.Recommendations
Update to version 4.5.10.
Update to version 4.6.2.
Exploit
Fix
XSS
Improper Encoding or Escaping of Output
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Jupyterlab