CVE-2026-6658
CVE-2026-6658 · Cross-site Scripting (XSS) in jupyter/nbconvert
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A vulnerability in jupyter/nbconvert versions <= 7.17.0 allows for Cross-site Scripting (XSS) via unsanitized `text/vnd.mermaid` output in HTML exports. The `data_mermaid` block in `share/templates/lab/base.html.j2` renders `text/vnd.mermaid` cell output directly into HTML without escaping, enabling attackers to inject arbitrary HTML/JavaScript by breaking out of the `<pre>` tag. This vulnerability impacts any server using nbconvert to render notebooks as HTML, allowing attackers to execute arbitrary JavaScript in the context of users viewing the HTML export.
CVSS 5.4 · Medium · EPSS 0.2%
- Published
- Updated
Stack: system
Affected products and versions
jupyter/jupyter
- Versions
- ≥ unspecified, ≤ latest: Affected (custom)
No fix published
nbconvert Debian:12
- Versions
- 6.5.3-3
- 6.5.3-4
- 6.5.3-5
- 7.16.4-1
- 7.16.4-2
- 7.16.5-1
- 7.16.6-1
- 7.17.0-1
- 7.17.1-1
- 7.17.1-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
nbconvert Debian:13
- Versions
- 7.16.6-1
- 7.16.6-1+deb13u1
- 7.17.0-1
- 7.17.1-1
- 7.17.1-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
nbconvert Debian:14
- Versions
- 7.16.6-1
- 7.17.0-1
- 7.17.1-1
- 7.17.1-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
nbconvert Ubuntu:18.04:LTS
- Versions
- 4.2.0-4
- 5.3.1-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
nbconvert Ubuntu:20.04:LTS
- Versions
- 5.4-2ubuntu2
- 5.6.0-1
- 5.6.0-2
- 5.6.1-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
nbconvert Ubuntu:22.04:LTS
- Versions
- 5.6.1-3
- 6.1.0-1
- 6.3.0-1
- 6.4.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
nbconvert Ubuntu:24.04:LTS
- Versions
- 6.5.3-4
- 6.5.3-5
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
nbconvert Ubuntu:25.10
- Versions
- 7.16.6-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
nbconvert Ubuntu:26.10
- Versions
- 7.17.0-1
- 7.17.1-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
nbconvert Ubuntu:26.04:LTS
- Versions
- 7.16.6-1
- 7.17.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published