CVE-2026-44727
CRITICAL
INFO
Priority: 0.04
BB Relevance:
59/100
Published: 2026-06-22
Modified: 2026-10-25
First seen: 2026-10-29
Status: active
Attack Surface
Network
Low Complexity
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
Low
UI:
Active
S:
X
AT:
None
VC:
High
VI:
High
VA:
High
Description
Jupyter Server is the backend for Jupyter web applications. Prior to 2.20, the nbconvert HTTP handlers in jupyter_server render user-authored notebook HTML under the Jupyter origin without a sandbox directive in their Content-Security-Policy. Combined with nbconvert.HTMLExporter's default non-sanitizing behavior, a notebook carrying an HTML payload in a display_data output triggers stored XSS with cookie access, full /api/* authority, and kernel RCE. This vulnerability is fixed in 2.20.
Affected Software (1)
| Vendor | Product | Version |
|---|---|---|
| jupyter | jupyter_server | < 2.20.0 |
References & Advisories (7)
Patch
Mitigation
Patch
Vendor Advisory