{"id":"CVE-2026-73417","summary":"JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)","details":"jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 3.3.0 until 4.5.10 and 4.6.2, JupyterLab allows notebook settings to be shared and applied through an overrides.json file using the Import button in the Settings Editor. In packages/notebook-extension/schema/tracker.json and packages/notebook-extension/src/index.ts, the sideBySideLeftMarginOverride and sideBySideRightMarginOverride settings are not properly validated before being inserted into style content, allowing a crafted settings file to contain instructions that execute as code instead of only changing display preferences. A user can import the malicious file, or an attacker with access to a shared settings location can plant an overrides.json that is applied automatically. The embedded code runs with the affected user's access and can read or modify notebooks and files and run code through the notebook server, including on a connected kernel. This issue is fixed in versions 4.5.10 and 4.6.2.","aliases":["GHSA-pppj-hq3g-57pj"],"modified":"2026-08-16T03:31:28.402880455Z","published":"2026-08-13T22:04:31.709Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73417.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-116","CWE-79"]},"references":[{"type":"WEB","url":"https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.10"},{"type":"WEB","url":"https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.2"},{"type":"WEB","url":"https://github.com/jupyterlab/jupyterlab/releases/tag/v4.7.0a1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73417.json"},{"type":"ADVISORY","url":"https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-pppj-hq3g-57pj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73417"},{"type":"FIX","url":"https://github.com/jupyterlab/jupyterlab/commit/9365f020baec5221deaf11535ed554c06637c999"},{"type":"FIX","url":"https://github.com/jupyterlab/jupyterlab/commit/be9303f5bcd5308eaeae953c5a3c903046682c2c"},{"type":"FIX","url":"https://github.com/jupyterlab/jupyterlab/commit/f1beab4a2027af4719d6edc07d52d6cf5a39a432"},{"type":"FIX","url":"https://github.com/jupyterlab/jupyterlab/pull/19184"},{"type":"FIX","url":"https://github.com/jupyterlab/jupyterlab/pull/19185"},{"type":"FIX","url":"https://github.com/jupyterlab/jupyterlab/pull/19186"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/jupyterlab/jupyterlab","events":[{"introduced":"892e74982c01d580a7080e4ad60d82dae590d3db"},{"introduced":"604d873f61b50ef6c3fadc048e05291cb09a7890"},{"fixed":"af5f5b3c779f6d7170c1124f5818807fa18f3f63"},{"fixed":"150ba51f1c840edc399597a86a6fc3ed24ef60be"},{"fixed":"9365f020baec5221deaf11535ed554c06637c999"},{"fixed":"be9303f5bcd5308eaeae953c5a3c903046682c2c"},{"fixed":"f1beab4a2027af4719d6edc07d52d6cf5a39a432"},{"fixed":"259ced222958b0bf2135e03e98d2eb31319890a5"}],"database_specific":{"extracted_events":[{"introduced":"3.3.0"},{"fixed":"4.5.10"},{"introduced":"4.6.0"},{"fixed":"4.6.2"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v4.6.1","@jupyterlab/workspaces@4.6.1","@jupyterlab/workspaces-extension@4.6.1","@jupyterlab/video-extension@4.6.1","@jupyterlab/vega5-extension@4.6.1","@jupyterlab/ui-components@4.6.1","@jupyterlab/ui-components-extension@4.6.1","@jupyterlab/translation@4.6.1","@jupyterlab/translation-extension@4.6.1","@jupyterlab/tooltip@4.6.1","@jupyterlab/tooltip-extension@4.6.1","@jupyterlab/toc@6.6.1","@jupyterlab/toc-extension@6.6.1","@jupyterlab/theme-light-extension@4.6.1","@jupyterlab/theme-dark-high-contrast-extension@4.6.1","@jupyterlab/theme-dark-extension@4.6.1","@jupyterlab/testutils@4.6.1","@jupyterlab/testing@4.6.1","@jupyterlab/terminal@4.6.1","@jupyterlab/terminal-extension@4.6.1","@jupyterlab/template@4.6.1","@jupyterlab/statusbar@4.6.1","@jupyterlab/statusbar-extension@4.6.1","@jupyterlab/statedb@4.6.1","@jupyterlab/shortcuts-extension@5.4.1","@jupyterlab/settingregistry@4.6.1","@jupyterlab/settingeditor@4.6.1","@jupyterlab/settingeditor-extension@4.6.1","@jupyterlab/services@7.6.1","@jupyterlab/services-extension@4.6.1","@jupyterlab/running@4.6.1","@jupyterlab/running-extension@4.6.1","@jupyterlab/rendermime@4.6.1","@jupyterlab/rendermime-interfaces@3.14.1","@jupyterlab/rendermime-extension@4.6.1","@jupyterlab/property-inspector@4.6.1","@jupyterlab/pluginmanager@4.6.1","@jupyterlab/pluginmanager-extension@4.6.1","@jupyterlab/pdf-extension@4.6.1","@jupyterlab/outputarea@4.6.1","@jupyterlab/observables@5.6.1","@jupyterlab/notebook@4.6.1","@jupyterlab/notebook-extension@4.6.1","@jupyterlab/nbformat@4.6.1","@jupyterlab/nbconvert-css@4.6.1","@jupyterlab/metapackage@4.6.1","@jupyterlab/metadataform@4.6.1","@jupyterlab/metadataform-extension@4.6.1","@jupyterlab/mermaid@4.6.1","@jupyterlab/mermaid-extension@4.6.1","@jupyterlab/mathjax-extension@4.6.1","@jupyterlab/markedparser-extension@4.6.1","@jupyterlab/markdownviewer@4.6.1","@jupyterlab/markdownviewer-extension@4.6.1","@jupyterlab/mainmenu@4.6.1","@jupyterlab/mainmenu-extension@4.6.1","@jupyterlab/lsp@4.6.1","@jupyterlab/lsp-extension@4.6.1","@jupyterlab/logconsole@4.6.1","@jupyterlab/logconsole-extension@4.6.1","@jupyterlab/launcher@4.6.1","@jupyterlab/launcher-extension@4.6.1","@jupyterlab/json-extension@4.6.1","@jupyterlab/javascript-extension@4.6.1","@jupyterlab/inspector@4.6.1","@jupyterlab/inspector-extension@4.6.1","@jupyterlab/imageviewer@4.6.1","@jupyterlab/imageviewer-extension@4.6.1","@jupyterlab/hub-extension@4.6.1","@jupyterlab/htmlviewer@4.6.1","@jupyterlab/htmlviewer-extension@4.6.1","@jupyterlab/help-extension@4.6.1","@jupyterlab/galata@5.6.1","@jupyterlab/fileeditor@4.6.1","@jupyterlab/fileeditor-extension@4.6.1","@jupyterlab/filebrowser@4.6.1","@jupyterlab/filebrowser-extension@4.6.1","@jupyterlab/extensionmanager@4.6.1","@jupyterlab/extensionmanager-extension@4.6.1","@jupyterlab/documentsearch@4.6.1","@jupyterlab/documentsearch-extension@4.6.1","@jupyterlab/docregistry@4.6.1","@jupyterlab/docmanager@4.6.1","@jupyterlab/docmanager-extension@4.6.1","@jupyterlab/debugger@4.6.1","@jupyterlab/debugger-extension@4.6.1","@jupyterlab/csvviewer@4.6.1","@jupyterlab/csvviewer-extension@4.6.1","@jupyterlab/coreutils@6.6.1","@jupyterlab/core-meta@4.6.1","@jupyterlab/console@4.6.1","@jupyterlab/console-extension@4.6.1","@jupyterlab/completer@4.6.1","@jupyterlab/completer-extension@4.6.1","@jupyterlab/codemirror@4.6.1","@jupyterlab/codemirror-extension@4.6.1","@jupyterlab/codeeditor@4.6.1","@jupyterlab/celltags-extension@4.6.1","@jupyterlab/cells@4.6.1","@jupyterlab/cell-toolbar@4.6.1","@jupyterlab/cell-toolbar-extension@4.6.1","@jupyterlab/buildutils@4.6.1","@jupyterlab/audio-extension@4.6.1","@jupyterlab/attachments@4.6.1","@jupyterlab/apputils@4.7.1","@jupyterlab/apputils-extension@4.6.1","@jupyterlab/application@4.6.1","@jupyterlab/application-extension@4.6.1","v4.7.0a0","@jupyterlab/workspaces@4.7.0-alpha.0","@jupyterlab/workspaces-extension@4.7.0-alpha.0","@jupyterlab/video-extension@4.7.0-alpha.0","@jupyterlab/vega5-extension@4.7.0-alpha.0","@jupyterlab/ui-components@4.7.0-alpha.0","@jupyterlab/ui-components-extension@4.7.0-alpha.0","@jupyterlab/translation@4.7.0-alpha.0","@jupyterlab/translation-extension@4.7.0-alpha.0","@jupyterlab/tooltip@4.7.0-alpha.0","@jupyterlab/tooltip-extension@4.7.0-alpha.0","@jupyterlab/toc@6.7.0-alpha.0","@jupyterlab/toc-extension@6.7.0-alpha.0","@jupyterlab/theme-light-extension@4.7.0-alpha.0","@jupyterlab/theme-dark-high-contrast-extension@4.7.0-alpha.0","@jupyterlab/theme-dark-extension@4.7.0-alpha.0","@jupyterlab/testutils@4.7.0-alpha.0","@jupyterlab/testing@4.7.0-alpha.0","@jupyterlab/terminal@4.7.0-alpha.0","@jupyterlab/terminal-extension@4.7.0-alpha.0","@jupyterlab/template@4.7.0-alpha.0","@jupyterlab/statusbar@4.7.0-alpha.0","@jupyterlab/statusbar-extension@4.7.0-alpha.0","@jupyterlab/statedb@4.7.0-alpha.0","@jupyterlab/shortcuts-extension@5.5.0-alpha.0","@jupyterlab/settingregistry@4.7.0-alpha.0","@jupyterlab/settingeditor@4.7.0-alpha.0","@jupyterlab/settingeditor-extension@4.7.0-alpha.0","@jupyterlab/services@7.7.0-alpha.0","@jupyterlab/services-extension@4.7.0-alpha.0","@jupyterlab/running@4.7.0-alpha.0","@jupyterlab/running-extension@4.7.0-alpha.0","@jupyterlab/rendermime@4.7.0-alpha.0","@jupyterlab/rendermime-interfaces@3.15.0-alpha.0","@jupyterlab/rendermime-extension@4.7.0-alpha.0","@jupyterlab/property-inspector@4.7.0-alpha.0","@jupyterlab/pluginmanager@4.7.0-alpha.0","@jupyterlab/pluginmanager-extension@4.7.0-alpha.0","@jupyterlab/pdf-extension@4.7.0-alpha.0","@jupyterlab/outputarea@4.7.0-alpha.0","@jupyterlab/observables@5.7.0-alpha.0","@jupyterlab/notebook@4.7.0-alpha.0","@jupyterlab/notebook-extension@4.7.0-alpha.0","@jupyterlab/nbformat@4.7.0-alpha.0","@jupyterlab/nbconvert-css@4.7.0-alpha.0","@jupyterlab/metapackage@4.7.0-alpha.0","@jupyterlab/metadataform@4.7.0-alpha.0","@jupyterlab/metadataform-extension@4.7.0-alpha.0","@jupyterlab/mermaid@4.7.0-alpha.0","@jupyterlab/mermaid-extension@4.7.0-alpha.0","@jupyterlab/mathjax-extension@4.7.0-alpha.0","@jupyterlab/markedparser-extension@4.7.0-alpha.0","@jupyterlab/markdownviewer@4.7.0-alpha.0","@jupyterlab/markdownviewer-extension@4.7.0-alpha.0","@jupyterlab/mainmenu@4.7.0-alpha.0","@jupyterlab/mainmenu-extension@4.7.0-alpha.0","@jupyterlab/lsp@4.7.0-alpha.0","@jupyterlab/lsp-extension@4.7.0-alpha.0","@jupyterlab/logconsole@4.7.0-alpha.0","@jupyterlab/logconsole-extension@4.7.0-alpha.0","@jupyterlab/launcher@4.7.0-alpha.0","@jupyterlab/launcher-extension@4.7.0-alpha.0","@jupyterlab/json-extension@4.7.0-alpha.0","@jupyterlab/javascript-extension@4.7.0-alpha.0","@jupyterlab/inspector@4.7.0-alpha.0","@jupyterlab/inspector-extension@4.7.0-alpha.0","@jupyterlab/imageviewer@4.7.0-alpha.0","@jupyterlab/imageviewer-extension@4.7.0-alpha.0","@jupyterlab/hub-extension@4.7.0-alpha.0","@jupyterlab/htmlviewer@4.7.0-alpha.0","@jupyterlab/htmlviewer-extension@4.7.0-alpha.0","@jupyterlab/help-extension@4.7.0-alpha.0","@jupyterlab/galata@5.7.0-alpha.0","@jupyterlab/fileeditor@4.7.0-alpha.0","@jupyterlab/fileeditor-extension@4.7.0-alpha.0","@jupyterlab/filebrowser@4.7.0-alpha.0","@jupyterlab/filebrowser-extension@4.7.0-alpha.0","@jupyterlab/extensionmanager@4.7.0-alpha.0","@jupyterlab/extensionmanager-extension@4.7.0-alpha.0","@jupyterlab/documentsearch@4.7.0-alpha.0","@jupyterlab/documentsearch-extension@4.7.0-alpha.0","@jupyterlab/docregistry@4.7.0-alpha.0","@jupyterlab/docmanager@4.7.0-alpha.0","@jupyterlab/docmanager-extension@4.7.0-alpha.0","@jupyterlab/debugger@4.7.0-alpha.0","@jupyterlab/debugger-extension@4.7.0-alpha.0","@jupyterlab/csvviewer@4.7.0-alpha.0","@jupyterlab/csvviewer-extension@4.7.0-alpha.0","@jupyterlab/coreutils@6.7.0-alpha.0","@jupyterlab/core-meta@4.7.0-alpha.0","@jupyterlab/console@4.7.0-alpha.0","@jupyterlab/console-extension@4.7.0-alpha.0","@jupyterlab/completer@4.7.0-alpha.0","@jupyterlab/completer-extension@4.7.0-alpha.0","@jupyterlab/codemirror@4.7.0-alpha.0","@jupyterlab/codemirror-extension@4.7.0-alpha.0","@jupyterlab/codeeditor@4.7.0-alpha.0","@jupyterlab/celltags-extension@4.7.0-alpha.0","@jupyterlab/cells@4.7.0-alpha.0","@jupyterlab/cell-toolbar@4.7.0-alpha.0","@jupyterlab/cell-toolbar-extension@4.7.0-alpha.0","@jupyterlab/buildutils@4.7.0-alpha.0","@jupyterlab/audio-extension@4.7.0-alpha.0","@jupyterlab/attachments@4.7.0-alpha.0","@jupyterlab/apputils@4.8.0-alpha.0","@jupyterlab/apputils-extension@4.7.0-alpha.0","@jupyterlab/application@4.7.0-alpha.0","@jupyterlab/application-extension@4.7.0-alpha.0","v4.6.0","@jupyterlab/workspaces@4.6.0","@jupyterlab/workspaces-extension@4.6.0","@jupyterlab/video-extension@4.6.0","@jupyterlab/vega5-extension@4.6.0","@jupyterlab/ui-components@4.6.0","@jupyterlab/ui-components-extension@4.6.0","@jupyterlab/translation@4.6.0","@jupyterlab/translation-extension@4.6.0","@jupyterlab/tooltip@4.6.0","@jupyterlab/tooltip-extension@4.6.0","@jupyterlab/toc@6.6.0","@jupyterlab/toc-extension@6.6.0","@jupyterlab/theme-light-extension@4.6.0","@jupyterlab/theme-dark-high-contrast-extension@4.6.0","@jupyterlab/theme-dark-extension@4.6.0","@jupyterlab/testutils@4.6.0","@jupyterlab/testing@4.6.0","@jupyterlab/terminal@4.6.0","@jupyterlab/terminal-extension@4.6.0","@jupyterlab/template@4.6.0","@jupyterlab/statusbar@4.6.0","@jupyterlab/statusbar-extension@4.6.0","@jupyterlab/statedb@4.6.0","@jupyterlab/shortcuts-extension@5.4.0","@jupyterlab/settingregistry@4.6.0","@jupyterlab/settingeditor@4.6.0","@jupyterlab/settingeditor-extension@4.6.0","@jupyterlab/services@7.6.0","@jupyterlab/services-extension@4.6.0","@jupyterlab/running@4.6.0","@jupyterlab/running-extension@4.6.0","@jupyterlab/rendermime@4.6.0","@jupyterlab/rendermime-interfaces@3.14.0","@jupyterlab/rendermime-extension@4.6.0","@jupyterlab/property-inspector@4.6.0","@jupyterlab/pluginmanager@4.6.0","@jupyterlab/pluginmanager-extension@4.6.0","@jupyterlab/pdf-extension@4.6.0","@jupyterlab/outputarea@4.6.0","@jupyterlab/observables@5.6.0","@jupyterlab/notebook@4.6.0","@jupyterlab/notebook-extension@4.6.0","@jupyterlab/nbformat@4.6.0","@jupyterlab/nbconvert-css@4.6.0","@jupyterlab/metapackage@4.6.0","@jupyterlab/metadataform@4.6.0","@jupyterlab/metadataform-extension@4.6.0","@jupyterlab/mermaid@4.6.0","@jupyterlab/mermaid-extension@4.6.0","@jupyterlab/mathjax-extension@4.6.0","@jupyterlab/markedparser-extension@4.6.0","@jupyterlab/markdownviewer@4.6.0","@jupyterlab/markdownviewer-extension@4.6.0","@jupyterlab/mainmenu@4.6.0","@jupyterlab/mainmenu-extension@4.6.0","@jupyterlab/lsp@4.6.0","@jupyterlab/lsp-extension@4.6.0","@jupyterlab/logconsole@4.6.0","@jupyterlab/logconsole-extension@4.6.0","@jupyterlab/launcher@4.6.0","@jupyterlab/launcher-extension@4.6.0","@jupyterlab/json-extension@4.6.0","@jupyterlab/javascript-extension@4.6.0","@jupyterlab/inspector@4.6.0","@jupyterlab/inspector-extension@4.6.0","@jupyterlab/imageviewer@4.6.0","@jupyterlab/imageviewer-extension@4.6.0","@jupyterlab/hub-extension@4.6.0","@jupyterlab/htmlviewer@4.6.0","@jupyterlab/htmlviewer-extension@4.6.0","@jupyterlab/help-extension@4.6.0","@jupyterlab/galata@5.6.0","@jupyterlab/fileeditor@4.6.0","@jupyterlab/fileeditor-extension@4.6.0","@jupyterlab/filebrowser@4.6.0","@jupyterlab/filebrowser-extension@4.6.0","@jupyterlab/extensionmanager@4.6.0","@jupyterlab/extensionmanager-extension@4.6.0","@jupyterlab/documentsearch@4.6.0","@jupyterlab/documentsearch-extension@4.6.0","@jupyterlab/docregistry@4.6.0","@jupyterlab/docmanager@4.6.0","@jupyterlab/docmanager-extension@4.6.0","@jupyterlab/debugger@4.6.0","@jupyterlab/debugger-extension@4.6.0","@jupyterlab/csvviewer@4.6.0","@jupyterlab/csvviewer-extension@4.6.0","@jupyterlab/coreutils@6.6.0","@jupyterlab/core-meta@4.6.0","@jupyterlab/console@4.6.0","@jupyterlab/console-extension@4.6.0","@jupyterlab/completer@4.6.0","@jupyterlab/completer-extension@4.6.0","@jupyterlab/codemirror@4.6.0","@jupyterlab/codemirror-extension@4.6.0","@jupyterlab/codeeditor@4.6.0","@jupyterlab/celltags-extension@4.6.0","@jupyterlab/cells@4.6.0","@jupyterlab/cell-toolbar@4.6.0","@jupyterlab/cell-toolbar-extension@4.6.0","@jupyterlab/buildutils@4.6.0","@jupyterlab/audio-extension@4.6.0","@jupyterlab/attachments@4.6.0","@jupyterlab/apputils@4.7.0","@jupyterlab/apputils-extension@4.6.0","@jupyterlab/application@4.6.0","@jupyterlab/application-extension@4.6.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73417.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:L"}]}