CVE-2026-73417

Source
https://cve.org/CVERecord?id=CVE-2026-73417
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73417.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-73417
Aliases
Downstream
Published
2026-08-13T22:04:31.709Z
Modified
2026-08-16T03:31:28.402880455Z
Severity
  • 8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:L CVSS Calculator
Summary
JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)
Details

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 3.3.0 until 4.5.10 and 4.6.2, JupyterLab allows notebook settings to be shared and applied through an overrides.json file using the Import button in the Settings Editor. In packages/notebook-extension/schema/tracker.json and packages/notebook-extension/src/index.ts, the sideBySideLeftMarginOverride and sideBySideRightMarginOverride settings are not properly validated before being inserted into style content, allowing a crafted settings file to contain instructions that execute as code instead of only changing display preferences. A user can import the malicious file, or an attacker with access to a shared settings location can plant an overrides.json that is applied automatically. The embedded code runs with the affected user's access and can read or modify notebooks and files and run code through the notebook server, including on a connected kernel. This issue is fixed in versions 4.5.10 and 4.6.2.

Database specific
{
    "cwe_ids": [
        "CWE-116",
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73417.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/jupyterlab/jupyterlab

Affected ranges

Type
GIT
Repo
https://github.com/jupyterlab/jupyterlab
Events
Database specific
Show details
{
    "extracted_events": [
        {
            "introduced": "3.3.0"
        },
        {
            "fixed": "4.5.10"
        },
        {
            "introduced": "4.6.0"
        },
        {
            "fixed": "4.6.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

@jupyterlab/application-extension@4.*
@jupyterlab/application-extension@4.6.0
@jupyterlab/application-extension@4.6.1
@jupyterlab/application-extension@4.7.0-alpha.0
@jupyterlab/application@4.*
@jupyterlab/application@4.6.0
@jupyterlab/application@4.6.1
@jupyterlab/application@4.7.0-alpha.0
@jupyterlab/apputils-extension@4.*
@jupyterlab/apputils-extension@4.6.0
@jupyterlab/apputils-extension@4.6.1
@jupyterlab/apputils-extension@4.7.0-alpha.0
@jupyterlab/apputils@4.*
@jupyterlab/apputils@4.7.0
@jupyterlab/apputils@4.7.1
@jupyterlab/apputils@4.8.0-alpha.0
@jupyterlab/attachments@4.*
@jupyterlab/attachments@4.6.0
@jupyterlab/attachments@4.6.1
@jupyterlab/attachments@4.7.0-alpha.0
@jupyterlab/audio-extension@4.*
@jupyterlab/audio-extension@4.6.0
@jupyterlab/audio-extension@4.6.1
@jupyterlab/audio-extension@4.7.0-alpha.0
@jupyterlab/buildutils@4.*
@jupyterlab/buildutils@4.6.0
@jupyterlab/buildutils@4.6.1
@jupyterlab/buildutils@4.7.0-alpha.0
@jupyterlab/cell-toolbar-extension@4.*
@jupyterlab/cell-toolbar-extension@4.6.0
@jupyterlab/cell-toolbar-extension@4.6.1
@jupyterlab/cell-toolbar-extension@4.7.0-alpha.0
@jupyterlab/cell-toolbar@4.*
@jupyterlab/cell-toolbar@4.6.0
@jupyterlab/cell-toolbar@4.6.1
@jupyterlab/cell-toolbar@4.7.0-alpha.0
@jupyterlab/cells@4.*
@jupyterlab/cells@4.6.0
@jupyterlab/cells@4.6.1
@jupyterlab/cells@4.7.0-alpha.0
@jupyterlab/celltags-extension@4.*
@jupyterlab/celltags-extension@4.6.0
@jupyterlab/celltags-extension@4.6.1
@jupyterlab/celltags-extension@4.7.0-alpha.0
@jupyterlab/codeeditor@4.*
@jupyterlab/codeeditor@4.6.0
@jupyterlab/codeeditor@4.6.1
@jupyterlab/codeeditor@4.7.0-alpha.0
@jupyterlab/codemirror-extension@4.*
@jupyterlab/codemirror-extension@4.6.0
@jupyterlab/codemirror-extension@4.6.1
@jupyterlab/codemirror-extension@4.7.0-alpha.0
@jupyterlab/codemirror@4.*
@jupyterlab/codemirror@4.6.0
@jupyterlab/codemirror@4.6.1
@jupyterlab/codemirror@4.7.0-alpha.0
@jupyterlab/completer-extension@4.*
@jupyterlab/completer-extension@4.6.0
@jupyterlab/completer-extension@4.6.1
@jupyterlab/completer-extension@4.7.0-alpha.0
@jupyterlab/completer@4.*
@jupyterlab/completer@4.6.0
@jupyterlab/completer@4.6.1
@jupyterlab/completer@4.7.0-alpha.0
@jupyterlab/console-extension@4.*
@jupyterlab/console-extension@4.6.0
@jupyterlab/console-extension@4.6.1
@jupyterlab/console-extension@4.7.0-alpha.0
@jupyterlab/console@4.*
@jupyterlab/console@4.6.0
@jupyterlab/console@4.6.1
@jupyterlab/console@4.7.0-alpha.0
@jupyterlab/core-meta@4.*
@jupyterlab/core-meta@4.6.0
@jupyterlab/core-meta@4.6.1
@jupyterlab/core-meta@4.7.0-alpha.0
@jupyterlab/coreutils@6.*
@jupyterlab/coreutils@6.6.0
@jupyterlab/coreutils@6.6.1
@jupyterlab/coreutils@6.7.0-alpha.0
@jupyterlab/csvviewer-extension@4.*
@jupyterlab/csvviewer-extension@4.6.0
@jupyterlab/csvviewer-extension@4.6.1
@jupyterlab/csvviewer-extension@4.7.0-alpha.0
@jupyterlab/csvviewer@4.*
@jupyterlab/csvviewer@4.6.0
@jupyterlab/csvviewer@4.6.1
@jupyterlab/csvviewer@4.7.0-alpha.0
@jupyterlab/debugger-extension@4.*
@jupyterlab/debugger-extension@4.6.0
@jupyterlab/debugger-extension@4.6.1
@jupyterlab/debugger-extension@4.7.0-alpha.0
@jupyterlab/debugger@4.*
@jupyterlab/debugger@4.6.0
@jupyterlab/debugger@4.6.1
@jupyterlab/debugger@4.7.0-alpha.0
@jupyterlab/docmanager-extension@4.*
@jupyterlab/docmanager-extension@4.6.0
@jupyterlab/docmanager-extension@4.6.1
@jupyterlab/docmanager-extension@4.7.0-alpha.0
@jupyterlab/docmanager@4.*
@jupyterlab/docmanager@4.6.0
@jupyterlab/docmanager@4.6.1
@jupyterlab/docmanager@4.7.0-alpha.0
@jupyterlab/docregistry@4.*
@jupyterlab/docregistry@4.6.0
@jupyterlab/docregistry@4.6.1
@jupyterlab/docregistry@4.7.0-alpha.0
@jupyterlab/documentsearch-extension@4.*
@jupyterlab/documentsearch-extension@4.6.0
@jupyterlab/documentsearch-extension@4.6.1
@jupyterlab/documentsearch-extension@4.7.0-alpha.0
@jupyterlab/documentsearch@4.*
@jupyterlab/documentsearch@4.6.0
@jupyterlab/documentsearch@4.6.1
@jupyterlab/documentsearch@4.7.0-alpha.0
@jupyterlab/extensionmanager-extension@4.*
@jupyterlab/extensionmanager-extension@4.6.0
@jupyterlab/extensionmanager-extension@4.6.1
@jupyterlab/extensionmanager-extension@4.7.0-alpha.0
@jupyterlab/extensionmanager@4.*
@jupyterlab/extensionmanager@4.6.0
@jupyterlab/extensionmanager@4.6.1
@jupyterlab/extensionmanager@4.7.0-alpha.0
@jupyterlab/filebrowser-extension@4.*
@jupyterlab/filebrowser-extension@4.6.0
@jupyterlab/filebrowser-extension@4.6.1
@jupyterlab/filebrowser-extension@4.7.0-alpha.0
@jupyterlab/filebrowser@4.*
@jupyterlab/filebrowser@4.6.0
@jupyterlab/filebrowser@4.6.1
@jupyterlab/filebrowser@4.7.0-alpha.0
@jupyterlab/fileeditor-extension@4.*
@jupyterlab/fileeditor-extension@4.6.0
@jupyterlab/fileeditor-extension@4.6.1
@jupyterlab/fileeditor-extension@4.7.0-alpha.0
@jupyterlab/fileeditor@4.*
@jupyterlab/fileeditor@4.6.0
@jupyterlab/fileeditor@4.6.1
@jupyterlab/fileeditor@4.7.0-alpha.0
@jupyterlab/galata@5.*
@jupyterlab/galata@5.6.0
@jupyterlab/galata@5.6.1
@jupyterlab/galata@5.7.0-alpha.0
@jupyterlab/help-extension@4.*
@jupyterlab/help-extension@4.6.0
@jupyterlab/help-extension@4.6.1
@jupyterlab/help-extension@4.7.0-alpha.0
@jupyterlab/htmlviewer-extension@4.*
@jupyterlab/htmlviewer-extension@4.6.0
@jupyterlab/htmlviewer-extension@4.6.1
@jupyterlab/htmlviewer-extension@4.7.0-alpha.0
@jupyterlab/htmlviewer@4.*
@jupyterlab/htmlviewer@4.6.0
@jupyterlab/htmlviewer@4.6.1
@jupyterlab/htmlviewer@4.7.0-alpha.0
@jupyterlab/hub-extension@4.*
@jupyterlab/hub-extension@4.6.0
@jupyterlab/hub-extension@4.6.1
@jupyterlab/hub-extension@4.7.0-alpha.0
@jupyterlab/imageviewer-extension@4.*
@jupyterlab/imageviewer-extension@4.6.0
@jupyterlab/imageviewer-extension@4.6.1
@jupyterlab/imageviewer-extension@4.7.0-alpha.0
@jupyterlab/imageviewer@4.*
@jupyterlab/imageviewer@4.6.0
@jupyterlab/imageviewer@4.6.1
@jupyterlab/imageviewer@4.7.0-alpha.0
@jupyterlab/inspector-extension@4.*
@jupyterlab/inspector-extension@4.6.0
@jupyterlab/inspector-extension@4.6.1
@jupyterlab/inspector-extension@4.7.0-alpha.0
@jupyterlab/inspector@4.*
@jupyterlab/inspector@4.6.0
@jupyterlab/inspector@4.6.1
@jupyterlab/inspector@4.7.0-alpha.0
@jupyterlab/javascript-extension@4.*
@jupyterlab/javascript-extension@4.6.0
@jupyterlab/javascript-extension@4.6.1
@jupyterlab/javascript-extension@4.7.0-alpha.0
@jupyterlab/json-extension@4.*
@jupyterlab/json-extension@4.6.0
@jupyterlab/json-extension@4.6.1
@jupyterlab/json-extension@4.7.0-alpha.0
@jupyterlab/launcher-extension@4.*
@jupyterlab/launcher-extension@4.6.0
@jupyterlab/launcher-extension@4.6.1
@jupyterlab/launcher-extension@4.7.0-alpha.0
@jupyterlab/launcher@4.*
@jupyterlab/launcher@4.6.0
@jupyterlab/launcher@4.6.1
@jupyterlab/launcher@4.7.0-alpha.0
@jupyterlab/logconsole-extension@4.*
@jupyterlab/logconsole-extension@4.6.0
@jupyterlab/logconsole-extension@4.6.1
@jupyterlab/logconsole-extension@4.7.0-alpha.0
@jupyterlab/logconsole@4.*
@jupyterlab/logconsole@4.6.0
@jupyterlab/logconsole@4.6.1
@jupyterlab/logconsole@4.7.0-alpha.0
@jupyterlab/lsp-extension@4.*
@jupyterlab/lsp-extension@4.6.0
@jupyterlab/lsp-extension@4.6.1
@jupyterlab/lsp-extension@4.7.0-alpha.0
@jupyterlab/lsp@4.*
@jupyterlab/lsp@4.6.0
@jupyterlab/lsp@4.6.1
@jupyterlab/lsp@4.7.0-alpha.0
@jupyterlab/mainmenu-extension@4.*
@jupyterlab/mainmenu-extension@4.6.0
@jupyterlab/mainmenu-extension@4.6.1
@jupyterlab/mainmenu-extension@4.7.0-alpha.0
@jupyterlab/mainmenu@4.*
@jupyterlab/mainmenu@4.6.0
@jupyterlab/mainmenu@4.6.1
@jupyterlab/mainmenu@4.7.0-alpha.0
@jupyterlab/markdownviewer-extension@4.*
@jupyterlab/markdownviewer-extension@4.6.0
@jupyterlab/markdownviewer-extension@4.6.1
@jupyterlab/markdownviewer-extension@4.7.0-alpha.0
@jupyterlab/markdownviewer@4.*
@jupyterlab/markdownviewer@4.6.0
@jupyterlab/markdownviewer@4.6.1
@jupyterlab/markdownviewer@4.7.0-alpha.0
@jupyterlab/markedparser-extension@4.*
@jupyterlab/markedparser-extension@4.6.0
@jupyterlab/markedparser-extension@4.6.1
@jupyterlab/markedparser-extension@4.7.0-alpha.0
@jupyterlab/mathjax-extension@4.*
@jupyterlab/mathjax-extension@4.6.0
@jupyterlab/mathjax-extension@4.6.1
@jupyterlab/mathjax-extension@4.7.0-alpha.0
@jupyterlab/mermaid-extension@4.*
@jupyterlab/mermaid-extension@4.6.0
@jupyterlab/mermaid-extension@4.6.1
@jupyterlab/mermaid-extension@4.7.0-alpha.0
@jupyterlab/mermaid@4.*
@jupyterlab/mermaid@4.6.0
@jupyterlab/mermaid@4.6.1
@jupyterlab/mermaid@4.7.0-alpha.0
@jupyterlab/metadataform-extension@4.*
@jupyterlab/metadataform-extension@4.6.0
@jupyterlab/metadataform-extension@4.6.1
@jupyterlab/metadataform-extension@4.7.0-alpha.0
@jupyterlab/metadataform@4.*
@jupyterlab/metadataform@4.6.0
@jupyterlab/metadataform@4.6.1
@jupyterlab/metadataform@4.7.0-alpha.0
@jupyterlab/metapackage@4.*
@jupyterlab/metapackage@4.6.0
@jupyterlab/metapackage@4.6.1
@jupyterlab/metapackage@4.7.0-alpha.0
@jupyterlab/nbconvert-css@4.*
@jupyterlab/nbconvert-css@4.6.0
@jupyterlab/nbconvert-css@4.6.1
@jupyterlab/nbconvert-css@4.7.0-alpha.0
@jupyterlab/nbformat@4.*
@jupyterlab/nbformat@4.6.0
@jupyterlab/nbformat@4.6.1
@jupyterlab/nbformat@4.7.0-alpha.0
@jupyterlab/notebook-extension@4.*
@jupyterlab/notebook-extension@4.6.0
@jupyterlab/notebook-extension@4.6.1
@jupyterlab/notebook-extension@4.7.0-alpha.0
@jupyterlab/notebook@4.*
@jupyterlab/notebook@4.6.0
@jupyterlab/notebook@4.6.1
@jupyterlab/notebook@4.7.0-alpha.0
@jupyterlab/observables@5.*
@jupyterlab/observables@5.6.0
@jupyterlab/observables@5.6.1
@jupyterlab/observables@5.7.0-alpha.0
@jupyterlab/outputarea@4.*
@jupyterlab/outputarea@4.6.0
@jupyterlab/outputarea@4.6.1
@jupyterlab/outputarea@4.7.0-alpha.0
@jupyterlab/pdf-extension@4.*
@jupyterlab/pdf-extension@4.6.0
@jupyterlab/pdf-extension@4.6.1
@jupyterlab/pdf-extension@4.7.0-alpha.0
@jupyterlab/pluginmanager-extension@4.*
@jupyterlab/pluginmanager-extension@4.6.0
@jupyterlab/pluginmanager-extension@4.6.1
@jupyterlab/pluginmanager-extension@4.7.0-alpha.0
@jupyterlab/pluginmanager@4.*
@jupyterlab/pluginmanager@4.6.0
@jupyterlab/pluginmanager@4.6.1
@jupyterlab/pluginmanager@4.7.0-alpha.0
@jupyterlab/property-inspector@4.*
@jupyterlab/property-inspector@4.6.0
@jupyterlab/property-inspector@4.6.1
@jupyterlab/property-inspector@4.7.0-alpha.0
@jupyterlab/rendermime-extension@4.*
@jupyterlab/rendermime-extension@4.6.0
@jupyterlab/rendermime-extension@4.6.1
@jupyterlab/rendermime-extension@4.7.0-alpha.0
@jupyterlab/rendermime-interfaces@3.*
@jupyterlab/rendermime-interfaces@3.14.0
@jupyterlab/rendermime-interfaces@3.14.1
@jupyterlab/rendermime-interfaces@3.15.0-alpha.0
@jupyterlab/rendermime@4.*
@jupyterlab/rendermime@4.6.0
@jupyterlab/rendermime@4.6.1
@jupyterlab/rendermime@4.7.0-alpha.0
@jupyterlab/running-extension@4.*
@jupyterlab/running-extension@4.6.0
@jupyterlab/running-extension@4.6.1
@jupyterlab/running-extension@4.7.0-alpha.0
@jupyterlab/running@4.*
@jupyterlab/running@4.6.0
@jupyterlab/running@4.6.1
@jupyterlab/running@4.7.0-alpha.0
@jupyterlab/services-extension@4.*
@jupyterlab/services-extension@4.6.0
@jupyterlab/services-extension@4.6.1
@jupyterlab/services-extension@4.7.0-alpha.0
@jupyterlab/services@7.*
@jupyterlab/services@7.6.0
@jupyterlab/services@7.6.1
@jupyterlab/services@7.7.0-alpha.0
@jupyterlab/settingeditor-extension@4.*
@jupyterlab/settingeditor-extension@4.6.0
@jupyterlab/settingeditor-extension@4.6.1
@jupyterlab/settingeditor-extension@4.7.0-alpha.0
@jupyterlab/settingeditor@4.*
@jupyterlab/settingeditor@4.6.0
@jupyterlab/settingeditor@4.6.1
@jupyterlab/settingeditor@4.7.0-alpha.0
@jupyterlab/settingregistry@4.*
@jupyterlab/settingregistry@4.6.0
@jupyterlab/settingregistry@4.6.1
@jupyterlab/settingregistry@4.7.0-alpha.0
@jupyterlab/shortcuts-extension@5.*
@jupyterlab/shortcuts-extension@5.4.0
@jupyterlab/shortcuts-extension@5.4.1
@jupyterlab/shortcuts-extension@5.5.0-alpha.0
@jupyterlab/statedb@4.*
@jupyterlab/statedb@4.6.0
@jupyterlab/statedb@4.6.1
@jupyterlab/statedb@4.7.0-alpha.0
@jupyterlab/statusbar-extension@4.*
@jupyterlab/statusbar-extension@4.6.0
@jupyterlab/statusbar-extension@4.6.1
@jupyterlab/statusbar-extension@4.7.0-alpha.0
@jupyterlab/statusbar@4.*
@jupyterlab/statusbar@4.6.0
@jupyterlab/statusbar@4.6.1
@jupyterlab/statusbar@4.7.0-alpha.0
@jupyterlab/template@4.*
@jupyterlab/template@4.6.0
@jupyterlab/template@4.6.1
@jupyterlab/template@4.7.0-alpha.0
@jupyterlab/terminal-extension@4.*
@jupyterlab/terminal-extension@4.6.0
@jupyterlab/terminal-extension@4.6.1
@jupyterlab/terminal-extension@4.7.0-alpha.0
@jupyterlab/terminal@4.*
@jupyterlab/terminal@4.6.0
@jupyterlab/terminal@4.6.1
@jupyterlab/terminal@4.7.0-alpha.0
@jupyterlab/testing@4.*
@jupyterlab/testing@4.6.0
@jupyterlab/testing@4.6.1
@jupyterlab/testing@4.7.0-alpha.0
@jupyterlab/testutils@4.*
@jupyterlab/testutils@4.6.0
@jupyterlab/testutils@4.6.1
@jupyterlab/testutils@4.7.0-alpha.0
@jupyterlab/theme-dark-extension@4.*
@jupyterlab/theme-dark-extension@4.6.0
@jupyterlab/theme-dark-extension@4.6.1
@jupyterlab/theme-dark-extension@4.7.0-alpha.0
@jupyterlab/theme-dark-high-contrast-extension@4.*
@jupyterlab/theme-dark-high-contrast-extension@4.6.0
@jupyterlab/theme-dark-high-contrast-extension@4.6.1
@jupyterlab/theme-dark-high-contrast-extension@4.7.0-alpha.0
@jupyterlab/theme-light-extension@4.*
@jupyterlab/theme-light-extension@4.6.0
@jupyterlab/theme-light-extension@4.6.1
@jupyterlab/theme-light-extension@4.7.0-alpha.0
@jupyterlab/toc-extension@6.*
@jupyterlab/toc-extension@6.6.0
@jupyterlab/toc-extension@6.6.1
@jupyterlab/toc-extension@6.7.0-alpha.0
@jupyterlab/toc@6.*
@jupyterlab/toc@6.6.0
@jupyterlab/toc@6.6.1
@jupyterlab/toc@6.7.0-alpha.0
@jupyterlab/tooltip-extension@4.*
@jupyterlab/tooltip-extension@4.6.0
@jupyterlab/tooltip-extension@4.6.1
@jupyterlab/tooltip-extension@4.7.0-alpha.0
@jupyterlab/tooltip@4.*
@jupyterlab/tooltip@4.6.0
@jupyterlab/tooltip@4.6.1
@jupyterlab/tooltip@4.7.0-alpha.0
@jupyterlab/translation-extension@4.*
@jupyterlab/translation-extension@4.6.0
@jupyterlab/translation-extension@4.6.1
@jupyterlab/translation-extension@4.7.0-alpha.0
@jupyterlab/translation@4.*
@jupyterlab/translation@4.6.0
@jupyterlab/translation@4.6.1
@jupyterlab/translation@4.7.0-alpha.0
@jupyterlab/ui-components-extension@4.*
@jupyterlab/ui-components-extension@4.6.0
@jupyterlab/ui-components-extension@4.6.1
@jupyterlab/ui-components-extension@4.7.0-alpha.0
@jupyterlab/ui-components@4.*
@jupyterlab/ui-components@4.6.0
@jupyterlab/ui-components@4.6.1
@jupyterlab/ui-components@4.7.0-alpha.0
@jupyterlab/vega5-extension@4.*
@jupyterlab/vega5-extension@4.6.0
@jupyterlab/vega5-extension@4.6.1
@jupyterlab/vega5-extension@4.7.0-alpha.0
@jupyterlab/video-extension@4.*
@jupyterlab/video-extension@4.6.0
@jupyterlab/video-extension@4.6.1
@jupyterlab/video-extension@4.7.0-alpha.0
@jupyterlab/workspaces-extension@4.*
@jupyterlab/workspaces-extension@4.6.0
@jupyterlab/workspaces-extension@4.6.1
@jupyterlab/workspaces-extension@4.7.0-alpha.0
@jupyterlab/workspaces@4.*
@jupyterlab/workspaces@4.6.0
@jupyterlab/workspaces@4.6.1
@jupyterlab/workspaces@4.7.0-alpha.0
v4.*
v4.6.0
v4.6.1
v4.7.0a0

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73417.json"