High [CVE-2026-73415] Arbitrary code execution via malicious image in image viewer
This high-severity Red Hat Linux advisory covers CVE-2026-73415 affecting Migration Toolkit for Applications 8, Red Hat OpenShift AI (RHOAI).
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture.
Prior to 4.5.10 and 4.6.2, in packages/imageviewer/src/widget.ts, JupyterLab's ImageViewer uses URL.createObjectURL for a specially crafted SVG image and revokes the blob URL too early, allowing the image to retain an executable same-origin context when it is opened through the image viewer and then opened in a new browser tab.
The resulting cross-site scripting can be used to execute arbitrary code on the JupyterLab server. This issue is fixed in versions 4.5.10 and 4.6.2.
A flaw was found in JupyterLab. This allows a remote attacker to exploit a cross-site scripting (XSS) vulnerability when a malicious image is opened through the image viewer and subsequently in a new browser tab.
Successful exploitation could lead to arbitrary code execution on the JupyterLab server. Red Hat severity: Important — CVSS 8 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H).
Weakness: CWE-911. Affected Red Hat products: Migration Toolkit for Applications 8; Red Hat OpenShift AI (RHOAI).
Red Hat does not currently list a fixing RHSA for this CVE.
- < 4.5.10
- < 4.6.2
Official advisory · high-confidence parse· fetched 3 hours ago·verify at source
- 4.5.10
- 4.6.2
- 4.7.0
Official advisory · high-confidence parse· fetched 3 hours ago·verify at source
Mitigation
Upgrade to a fixed release: 4.5.10, 4.6.2, 4.7.0. That is the remediation for this advisory.
The vendor advisory may list additional interim mitigations or workarounds not captured here — review it before change work.
Official advisory · high-confidence parse· fetched 3 hours ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.