9.3
Critique
CVE-2026-44727 Jupyter Server is the backend for Jupyter web applications
Description
Jupyter Server is the backend for Jupyter web applications. Prior to 2.20, the nbconvert HTTP handlers in jupyter_server render user-authored notebook HTML under the Jupyter origin without a sandbox directive in their Content-Security-Policy. Combined with nbconvert.HTMLExporter's default non-sanitizing behavior, a notebook carrying an HTML payload in a display_data output triggers stored XSS with cookie access, full /api/* authority, and kernel RCE. This vulnerability is fixed in 2.20.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| jupyter_server 2.20 | premières → < 2.20 | 2.20 |
| Migration Toolkit for Applications 8 | Versions non publiées | |
| Red Hat OpenShift AI (RHOAI) | Versions non publiées | |
| Red Hat Migration Toolkit for Applications 8.2 1784109883 | premières → < 1784109883 | 1784109883 |
| Red Hat OpenShift AI 3.4 1787073593 | premières → < 1787073593 | 1787073593 |
Références
- github.com github.com
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de jupyter_server
Les 14 CVE de jupyter_server →
CVE-2026-114135
Jupyter Server is the backend for Jupyter web applications
8.8
Élevée
CVE-2026-86049
Jupyter Server is the backend for Jupyter web applications
7.1
Élevée
CVE-2026-40934
Jupyter Server is the backend for Jupyter web applications
7.6
Élevée
CVE-2026-40110
Jupyter Server is the backend for Jupyter web applications
7.6
Élevée