Which versions of Jupyter Server are affected by CVE-2026-44727?

Jupyter Server versions before 2.20.0 contain a vulnerability enabling attackers to steal user credentials and control server operations via malicious notebooks.. A patch is available.

How to fix or mitigate CVE-2026-44727?

Within 24 hours: Identify all Jupyter Server instances and their current versions. Within 7 days: Upgrade all instances to Jupyter Server v2.20.0 or later. Within 30 days: Review audit logs for suspicious API activity from the vulnerability window and confirm all instances are updated.

Jupyter Server CVE-2026-44727

Q: What is the CVSS score of CVE-2026-44727?

CVE-2026-44727 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-38347 CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-06-18 https://github.com/jupyter-server/jupyter_server

GHSA-fcw5-x6j4-ccmp

XSS

9.3

CVSS 4.0 · Vendor: https://github.com/jupyter-server/jupyter_server

Severity by source

Vendor (https://github.com/jupyter-server/jupyter_server) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.0 CRITICAL

Network-reachable handler with low complexity; victim must be authenticated to Jupyter (PR:L) and must navigate to the malicious nbconvert URL (UI:R); kernel RCE crosses a trust boundary so S:C with full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.0 HIGH

qualitative

Primary rating from Vendor (https://github.com/jupyter-server/jupyter_server).

CVSS VectorVendor: https://github.com/jupyter-server/jupyter_server

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Updated

Jun 22, 2026 - 21:43 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 22, 2026 - 21:43 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 22, 2026 - 21:39 vuln.today

cvss_changed

CVSS changed

Jun 22, 2026 - 21:39 NVD

9.3 (CRITICAL)

Source Code Evidence Fetched

Jun 18, 2026 - 15:52 vuln.today

Analysis Generated

Jun 18, 2026 - 15:52 vuln.today

DescriptionCVE.org

The nbconvert HTTP handlers in jupyter_server render user-authored notebook HTML under the Jupyter origin without a sandbox directive in their Content-Security-Policy.

Combined with nbconvert.HTMLExporter's default non-sanitizing behavior, a notebook carrying an HTML payload in a display_data output triggers stored XSS with cookie access, full /api/* authority, and kernel RCE.

Impact

An authenticated victim who navigates to /nbconvert/html/<path> containing attacker-authored output can have their token exfiltrated to another domain because it is executed in the Jupyter origin.

Patches

Fixed in v2.20.0, commit 6cbee8d

Workarounds

For deployments where editing the installed jupyter_server is impractical (containerized builds, read-only images), adding this to jupyter_server_config.py has the same effect as the patch above without touching source files:

import jupyter_server.nbconvert.handlers as _nb

def _csp(self):
    return super(type(self), self).content_security_policy + "; sandbox allow-scripts"

_nb.NbconvertFileHandler.content_security_policy = property(_csp)
_nb.NbconvertPostHandler.content_security_policy = property(_csp)

AnalysisAI

Stored cross-site scripting in jupyter_server's nbconvert HTTP handlers allows a malicious notebook to execute JavaScript in the Jupyter origin, leading to session token theft, full /api/* control, and kernel remote code execution. The NbconvertFileHandler and NbconvertPostHandler render notebook-authored HTML without a CSP sandbox directive, and combined with HTMLExporter's non-sanitizing default, any display_data HTML payload runs with the victim's authority. No public exploit identified at time of analysis, but the CVSS 4.0 base score is 9.3 and a vendor patch is available in v2.20.0.

Technical ContextAI

jupyter_server is the Python backend that powers JupyterLab, Jupyter Notebook 7+, and many derivative data-science environments; the nbconvert handlers expose endpoints like /nbconvert/html/<path> that convert .ipynb files to HTML on the fly via nbconvert.HTMLExporter. CWE-79 (Improper Neutralization of Input During Web Page Generation) applies because the exporter does not sanitize HTML/JS embedded in display_data outputs, and the handlers serve the result under the Jupyter origin with a Content-Security-Policy that lacked the 'sandbox' directive - meaning any embedded script could read cookies (the Jupyter auth token), call /api/* endpoints, and reach the kernel-execution API. The fix introduces a new ServerApp.nbconvert_csp_sandbox boolean (default True) that appends 'sandbox allow-scripts' to the CSP for both NbconvertFileHandler and NbconvertPostHandler, confining rendered notebook JavaScript to a unique opaque origin. Affected package per CPE pkg:pip/jupyter-server covers versions <= 2.19.0.

RemediationAI

Vendor-released patch: upgrade jupyter_server to 2.20.0 or later (pip install --upgrade 'jupyter-server>=2.20.0'), which adds the 'sandbox allow-scripts' directive to the CSP on /nbconvert/ endpoints by default via the new ServerApp.nbconvert_csp_sandbox setting; the change is in commit 6cbee8d (https://github.com/jupyter-server/jupyter_server/commit/6cbee8d65e71abac851c4492fea987ad080580bd) and documented in advisory GHSA-fcw5-x6j4-ccmp. For containerized or read-only deployments where upgrading is impractical, the vendor-supplied workaround is to monkey-patch the handlers in jupyter_server_config.py by setting NbconvertFileHandler.content_security_policy and NbconvertPostHandler.content_security_policy to a property that appends '; sandbox allow-scripts' to the inherited CSP, which produces the same defense without modifying installed source. As a compensating control, operators of multi-user environments can also disable or proxy-strip the /nbconvert/html/ and /nbconvert/ POST endpoints at a reverse proxy (trade-off: users lose in-server HTML export and must download .ipynb files for local conversion), and should advise users not to open untrusted notebooks via nbconvert until patched.