CVE-2026-6658mediumCWE-79

CVE-2026-6658: fallo de gravedad media en jupyter/jupyter

Cross-site Scripting (XSS) in jupyter/nbconvert

Publicada el

Seguir esta CVE+ Monitorear jupyter/jupyter+ Monitorear nbconvert

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.4epss 0.2%
A vulnerability in jupyter/nbconvert versions <= 7.17.0 allows for Cross-site Scripting (XSS) via unsanitized `text/vnd.mermaid` output in HTML exports. The `data_mermaid` block in `share/templates/lab/base.html.j2` renders `text/vnd.mermaid` cell output directly into HTML without escaping, enabling attackers to inject arbitrary HTML/JavaScript by breaking out of the `<pre>` tag. This vulnerability impacts any server using nbconvert to render notebooks as HTML, allowing attackers to execute arbitrary JavaScript in the context of users viewing the HTML export.
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Productos afectados
jupyter · jupyter/jupyter
CVEs relacionadas — jupyter/jupyter

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-6657MEDIUMCORS Origin Validation Bypass in jupyter-serverEPSS 5.2%CVE-2026-5422MEDIUMPath Traversal in jupyter/jupyterEPSS 4.9%