Cross-Site Scripting Vulnerability in jupyter/nbconvert Affects Multiple Versions
CVE-2026-6658

5.4MEDIUM

Key Information:

Vendor

Jupyter

Status
Jupyter/jupyter
Vendor
CVE Published:
26 June 2026

What is CVE-2026-6658?

A vulnerability in jupyter/nbconvert versions up to and including 7.17.0 allows for Cross-Site Scripting (XSS) attacks. This arises from the unsanitized rendering of text/vnd.mermaid cell outputs into HTML exports. The vulnerability occurs in the data_mermaid block of share/templates/lab/base.html.j2, where the output is directly incorporated into HTML without proper escaping. This gap enables attackers to inject arbitrary HTML and JavaScript, potentially executing malicious scripts in the context of users viewing the exported HTML, posing serious security risks to any server utilizing nbconvert.

Affected Version(s)

jupyter/jupyter <= unspecified

References

https://huntr.com/bounties/47570290-3b26-4477-8cfa-fdef7d...

CVSS V3.0

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.