Aller au contenu
Se connecter
5.4 Moyenne

CVE-2026-6658 A vulnerability in jupyter/nbconvert…

Description

A vulnerability in jupyter/nbconvert versions <= 7.17.0 allows for Cross-site Scripting (XSS) via unsanitized `text/vnd.mermaid` output in HTML exports. The `data_mermaid` block in `share/templates/lab/base.html.j2` renders `text/vnd.mermaid` cell output directly into HTML without escaping, enabling attackers to inject arbitrary HTML/JavaScript by breaking out of the `<pre>` tag. This vulnerability impacts any server using nbconvert to render notebooks as HTML, allowing attackers to execute arbitrary JavaScript in the context of users viewing the HTML export.

Produits et versions touchés

Produit Versions touchées Corrigé en
jupyter/jupyter Versions non publiées

Autres CVE de jupyter/jupyter

Les 3 CVE de jupyter/jupyter →
CVE-2026-6657 A vulnerability in jupyter-server versions 1.12.0 through 2.17.0 allows an attacker to bypass CORS origin validation… 6.1 Moyenne CVE-2026-5422 A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check… 6.8 Moyenne
Suivre cette CVE