What is the CVSS score of CVE-2026-6658?

CVE-2026-6658 has a CVSS 3.0 base score of 5.4 (Medium). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Jupyter nbconvert CVE-2026-6658

EUVD-2026-39642 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-26 @huntr_ai

GHSA-9754-6rhw-gj3h

XSS Red Hat Suse Jupyter Jupyter Jupyter

5.4

CVSS 3.0 · Vendor: huntr_ai

Severity by source

Vendor (huntr_ai) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

PR:L reflects required notebook write access; UI:R reflects victim must view HTML export; S:C captures cross-browser-session impact; no availability impact applies.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

SUSE

MEDIUM

qualitative

Red Hat

5.4 MEDIUM

qualitative

Primary rating from Vendor (huntr_ai).

CVSS VectorVendor: huntr_ai

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 10:16 vuln.today

DescriptionCVE.org

A vulnerability in jupyter/nbconvert versions <= 7.17.0 allows for Cross-site Scripting (XSS) via unsanitized text/vnd.mermaid output in HTML exports. The data_mermaid block in share/templates/lab/base.html.j2 renders text/vnd.mermaid cell output directly into HTML without escaping, enabling attackers to inject arbitrary HTML/JavaScript by breaking out of the <pre> tag. This vulnerability impacts any server using nbconvert to render notebooks as HTML, allowing attackers to execute arbitrary JavaScript in the context of users viewing the HTML export.

AnalysisAI

Cross-site scripting in jupyter/nbconvert versions 7.17.0 and earlier allows any user with notebook write access to inject and execute arbitrary JavaScript in the browsers of users who view HTML-exported notebooks. The flaw stems from the data_mermaid rendering block in share/templates/lab/base.html.j2, which outputs text/vnd.mermaid cell content directly into HTML without escaping, enabling tag breakout from the enclosing <pre> element. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the stored-XSS pattern means any user who views a maliciously crafted HTML export is at risk.

Technical ContextAI

nbconvert is the Jupyter ecosystem's primary notebook-to-HTML (and other format) conversion tool, used extensively in JupyterHub deployments, CI pipelines, and documentation publishing workflows. The vulnerability lies in the Jinja2 template share/templates/lab/base.html.j2, which contains a data_mermaid block responsible for rendering cell outputs of MIME type text/vnd.mermaid - a diagramming format supported in modern Jupyter Lab. Because the template emits this content inside a <pre> tag without applying HTML entity encoding or a Content Security Policy sanitization step, an attacker-controlled Mermaid payload such as </pre><script>...</script> trivially escapes the tag context. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the stored variant: the malicious payload is baked into the exported HTML file at conversion time and fires for every subsequent viewer. The CPE provided is cpe:2.3:a:jupyter:jupyter/jupyter:*:*:*:*:*:*:*:*; the canonical package is jupyter/nbconvert on PyPI.

RemediationAI

Upgrade jupyter/nbconvert to any version released after 7.17.0 once a patched release is available; no exact fix version has been confirmed from the available references, so monitor the nbconvert PyPI release page and the Huntr advisory at https://huntr.com/bounties/47570290-3b26-4477-8cfa-fdef7db5aefe for the confirmed patch release. Until a patch is available, the most direct compensating control is to disable or strip text/vnd.mermaid MIME-type outputs from notebooks before conversion - this can be done via a custom nbconvert preprocessor or by scrubbing the notebook JSON with a pre-export script, though this will break legitimate Mermaid diagram rendering. Alternatively, serve HTML exports only from a sandboxed origin with a strict Content Security Policy (script-src 'none' or nonce-based) to neutralize injected scripts without affecting the page layout. Restricting HTML export generation to trusted notebook authors and educating users not to open HTML exports from untrusted sources are additional layered controls. Note that disabling Mermaid rendering entirely affects legitimate diagramming use cases.