JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab
JupyterLab's image viewer allows for cross-site scripting (XSS) when a specially-crafted image file is opened through the image viewer and then opened in a new tab. This XSS issue can be used to cause remote code execution (RCE) on the JupyterLab server.
This vulnerability allows for arbitrary code execution.
JupyterLab v4.6.2 and v4.5.10 contain the patch.
Disable the image viewer plugin:
jupyter labextension disable @jupyterlab/imageviewer-extension:plugin
Confirm with:
jupyter labextension list