Code Execution Vulnerability in JupyterLab Allows Malicious Code Execution
CVE-2026-73417
8.6HIGH
What is CVE-2026-73417?
JupyterLab is an interactive computing environment that allows users to share settings through an overrides.json file. A vulnerability exists in versions from 3.3.0 to 4.5.10 and in 4.6.2, where certain notebook settings are not properly validated. This allows malicious code to be embedded within the settings file. When the user imports this file, it executes code with the user's access permissions, enabling unauthorized access to notebooks and files, and the ability to run code through the notebook server. The issue has been resolved in versions 4.5.10 and 4.6.2.
Affected Version(s)
jupyterlab >= 3.3.0, < 4.5.10 < 3.3.0, 4.5.10
jupyterlab >= 4.6.0, < 4.6.2 < 4.6.0, 4.6.2