CVE-2026-6658CWE-79

Cross-site Scripting (XSS) in jupyter/nbconvert

Medium · published June 26, 2026

CVSS v3.0
5.4
EPSS
0%
Percentile
12.7
In the wild
Unconfirmed
What it is

A vulnerability in jupyter/nbconvert versions <= 7.17.0 allows for Cross-site Scripting (XSS) via unsanitized `text/vnd.mermaid` output in HTML exports. The `data_mermaid` block in `share/templates/lab/base.html.j2` renders `text/vnd.mermaid` cell output directly into HTML without escaping, enabling attackers to inject arbitrary HTML/JavaScript by breaking out of the `<pre>` tag. This vulnerability impacts any server using nbconvert to render notebooks as HTML, allowing attackers to execute arbitrary JavaScript in the context of users viewing the HTML export.

The record
Technical detail
CVSS v3.0
5.4 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00227 · 12.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-06-26T09:40Z
EPSS history
Timeline
  • 26 JUN 09:40Z
    Cross-site Scripting (XSS) in jupyter/nbconvert
    cvelistv5