Loading story…
JupyterLab is affected by high-severity vulnerabilities that can lead to arbitrary code execution, security restriction bypass, and information disclosure, prompting an alert from Italy's national cybersecurity agency. The most detailed issue disclosed is CVE-2026-73417, a cross-site scripting flaw caused by improper validation of notebook margin override settings before they are inserted into style content.
An attacker can exploit CVE-2026-73417 by persuading a user to import a malicious overrides.json settings file or by placing that file in a shared settings location so it is applied automatically. Successful exploitation allows code to run with the victim's privileges, enabling reading or modifying notebooks and files and executing code through the notebook server, including on a connected kernel. The flaw affects JupyterLab versions 3.3.0 through 4.5.9 and 4.6.0 through 4.6.1; fixes are available in 4.5.10 and 4.6.2, and organizations are advised to update vulnerable installations in line with vendor guidance.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
On August 13, 2026, the CVE record for CVE-2026-73417 was published, describing a high-severity JupyterLab XSS vulnerability affecting versions from 3.3.0 to before 4.5.10 and 4.6.0 to before 4.6.2. The record links the flaw to GitHub advisory GHSA-pppj-hq3g-57pj and recommends updating to fixed versions.
CSIRT Italia reported two high-severity vulnerabilities in JupyterLab that could enable arbitrary code execution, bypass security restrictions, and disclose information. The notice said affected versions include 4.5.9 and earlier and 4.6.0 through 4.6.1, and advised users to apply vendor updates.
JupyterLab addressed a high-severity cross-site scripting flaw, CVE-2026-73417, in releases 4.5.10 and 4.6.2. The issue could allow crafted settings in overrides.json to execute code with the victim user's privileges.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability has been identified in the *nbconvert* tool, specifically affecting Jupyter environments on Windows. When converting a notebook containing SVG output to PDF using `jupyter nbconvert --to pdf`, the tool may inadvertently execute a malicious `inkscape.bat` file if present in the working directory, leading to unauthorized code execution. This flaw, tracked as CVE-2025-53000, impacts all versions up to and including 7.16.6, and currently, no official patch is available. The vulnerability is not remotely exploitable but poses a significant risk if an attacker can place a crafted batch file in a directory where a user performs notebook exports. Security researchers have highlighted the broader risks associated with Jupyter notebook export functionality, emphasizing how threat actors could exploit external notebooks to compromise user workstations. The research underscores the importance of securing Jupyter environments, recommending the use of centralized servers, regular updates, and strict controls over external files processed by Jupyter software. The attack vector leverages the fact that configuration files in Jupyter are valid Python executables, making them particularly susceptible to exploitation if not properly managed.
Jun 29, 2026
Researchers disclosed a remote code execution chain affecting default self-managed GitLab installations by exploiting two memory-safety flaws in the Ruby JSON parser **Oj** during Jupyter Notebook diff processing. The issue became reachable through GitLab’s handling of `.ipynb` files via the `ipynbdiff` component, allowing an authenticated user with permission to push commits and view diffs to upload crafted notebook files and execute arbitrary shell commands as the `git` user without administrator privileges or user interaction. The exploit combined a one-byte memory overwrite with a heap information leak to bypass ASLR, corrupt parser state, and redirect execution to `system()`, aided by Puma thread reuse of the vulnerable parser instance. Researchers said successful compromise could expose source code, Rails secrets, service credentials, and internal services, creating opportunities for data theft, code tampering, and lateral movement. GitLab released fixes for CE/EE versions **18.10.8**, **18.11.5**, and **19.0.2**, while **Oj 3.17.3** patched the underlying library flaws; GitLab.com had already been updated before disclosure, and public proof-of-concept code has increased risk for unpatched deployments.
Jul 27, 2026
Jupyter Server disclosed and fixed a **stored cross-site scripting** flaw in `NbconvertFileHandler` and `NbconvertPostHandler` that affects versions up to and including `2.19.0`. The issue stems from nbconvert endpoints rendering user-authored notebook HTML under the Jupyter origin without a `sandbox` directive in the `Content-Security-Policy`, while `nbconvert.HTMLExporter` does not sanitize HTML by default. An attacker can place malicious HTML in notebook `display_data` output and trigger script execution when an authenticated user opens `/nbconvert/html/<path>`. Successful exploitation could expose tokens and cookies, grant access to Jupyter ` /api/* ` endpoints, and potentially enable remote code execution through kernels. The project addressed the issue in **jupyter-server `2.20.0`** by adding `sandbox allow-scripts` to the CSP header for rendered nbconvert HTML in both GET and POST handlers, isolating any JavaScript in a unique origin. The mitigation is enabled by default through the new `ServerApp.nbconvert_csp_sandbox` setting, and the change is documented and covered by tests; a configuration-based workaround is also available for deployments that cannot easily patch source files.
Jun 29, 2026