Cross-site Scripting (XSS) in jupyter/nbconvert
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Deferred Red Hat: fix deferred
Attack profile from CVSS 3.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.
Summary
A vulnerability in jupyter/nbconvert versions <= 7.17.0 allows for Cross-site Scripting (XSS) via unsanitized `text/vnd.mermaid` output in HTML exports. The `data_mermaid` block in `share/templates/lab/base.html.j2` renders `text/vnd.mermaid` cell output directly into HTML without escaping, enabling attackers to inject arbitrary HTML/JavaScript by breaking out of the `<pre>` tag. This vulnerability impacts any server using nbconvert to render notebooks as HTML, allowing attackers to execute arbitrary JavaScript in the context of users viewing the HTML export.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| jupyterlab | jupyter/jupyter | up to latest | — | No fix listed | CNA |
| — | nbconvert (PyPI) | up to 7.17.0 | — | No fix listed | GHSA-9754-6rhw-gj3h |
- jupyter/jupyter Vendorjupyterlab Affected up to latest Fixed in — No fix listed CNA
- nbconvert (PyPI) Vendor— Affected up to 7.17.0 Fixed in — No fix listed GHSA-9754-6rhw-gj3h
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Migration Toolkit for Applications 8 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat Satellite 6 | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-6658
- 2026-10-03 Alias added: GHSA-9754-6rhw-gj3h
- 2026-11-06 Affected versions changed · GHSA-9754-6rhw-gj3h
- 2026-11-06 CVSS score added · GHSA-9754-6rhw-gj3h
- 2026-11-06 Weakness changed · GHSA-9754-6rhw-gj3h
- 2026-11-06 3 new references · GHSA-9754-6rhw-gj3h
References
More jupyterlab vulnerabilities
- TI-2026-32161 Jupyter Enterprise Gateway Has Kubernetes Manifest Injection via Jinja2 Template Rendering CVSS 4.0CRITICAL 10.0
- TI-2026-32160 Jupyter Enterprise Gateway: Jinja2 Template Server Side Template Injection results in Remote Code Execution CVSS 4.0CRITICAL 10.0
- TI-2026-32159 Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_prohibited_ids can be Bypassed CVSS 3.1CRITICAL 9.8
- TI-2024-26623 Remote Code Execution (RCE) vulnerability in jupyterlab extension template `update-integration-tests` GitHub Action CVSS 3.1CRITICAL 10.0
- TI-2026-78983 Path traversal in nbconvert lets crafted notebooks write files CVSS 4.0HIGH 8.8
- TI-2026-39372 JupyterLab Git: Stored XSS leading to RCE CVSS 4.0CRITICAL 9.3
Sources
- CVE-2026-6658 · CVE Program
- CVE-2026-6658 · NVD
- FIRST EPSS
- GHSA-9754-6rhw-gj3h · GitHub Advisory Database · CC BY 4.0
- CVE-2026-6658 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences