High-Severity XSS Flaw Found in JupyterLab Image Viewer, Patch Now Available

·1 views

A stored Cross-Site Scripting vulnerability (CVSS 8.2) has been disclosed in JupyterLab's Image Viewer component, tracked as GHSA-GX64-GJ6P-PC4C and published on July 22, 2026. The flaw allows attackers to embed malicious JavaScript inside SVG files, which executes within a victim's active session when the image is opened in a new browser tab. Exploitation can lead to arbitrary remote command execution and potential host takeover, with a proof-of-concept already available. Affected versions include JupyterLab 4.6.0 up to 4.6.2 and certain earlier 4.5.x releases, with fixes delivered in versions 4.5.10 and 4.6.2. Users are advised to upgrade immediately via pip or conda, enforce a Content Security Policy, and restrict raw SVG uploads in shared multi-user environments.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Gemini 3.6 Flash cuts token usage 17%, costs drop alongside Python cold start times

Google has released Gemini 3.6 Flash, which delivers 17% fewer output tokens compared to its predecessor, Gemini 3.5 Flash, with pricing set at $1.50 per million input tokens and $7.50 per million output tokens. The efficiency gains are most notable on coding and web tasks, making it particularly relevant for production agentic systems where multi-step workflows compound inference costs. A companion model, Gemini 3.5 Flash-Lite, offers higher throughput at 350 output tokens per second at a lower price point, targeting high-volume workloads like document classification. Both models are immediately available via Vercel's AI Gateway using a single parameter change, allowing teams already routing other providers through the gateway to add Gemini without a separate integration. Python cold start times have also been halved in the same release cycle, requiring no code changes from developers.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

citesure tool adds citation integrity checks to research repos from day one

A new Python tool called citesure aims to prevent bibliography errors in academic papers by embedding citation validation directly into a project repository at setup. Common mistakes such as placeholder DOIs, incorrect page ranges, and malformed metadata are caught early through pre-commit hooks and GitHub Actions workflows. The tool supports live verification against databases including Crossref, PubMed, arXiv, and OpenAlex, among others. Users can initialise a paper repository with a single command, which also generates configuration files and contributor guidelines. citesure is available on GitHub and includes 55 pre-built citation packs spanning fields such as sociology, ecology, law, and machine learning.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Key Backend Design Patterns Every Developer Should Learn Early

A software developer reflecting on their backend engineering journey highlights that experienced engineers excel not by knowing more tools, but by recognizing recurring problem patterns. Three foundational patterns are identified: the Repository Pattern, which isolates database logic from the rest of the application; the Service Layer Pattern, which separates business rules from controller logic; and Dependency Injection, which decouples class dependencies to improve testability and flexibility. The Repository Pattern, for example, allows the underlying database to be swapped without affecting business logic. Together, these patterns reduce complexity, lower maintenance costs, and make systems more resilient to change.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

ES2025 adds native Set methods for union, intersection, and difference in JavaScript

JavaScript's ES2025 specification has introduced seven new built-in methods for the Set object, including union(), intersection(), difference(), symmetricDifference(), isSubsetOf(), isSupersetOf(), and isDisjointFrom(). Although the Set data structure has been part of JavaScript since ES6 in 2015, it lacked native support for standard set-theory operations until now. Each method accepts any set-like object — defined as having a size property, a has() method, and a keys() iterator — meaning Maps and custom structures are also compatible. Previously, developers had to write multi-line manual workarounds using spread operators and filter functions to achieve the same results. TypeScript added type support for these methods in version 5.5 under the ES2025 library configuration.

0 comments Read more at DEV Community