EUVD-2026-38347
GHSA-fcw5-x6j4-ccmp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable handler with low complexity; victim must be authenticated to Jupyter (PR:L) and must navigate to the malicious nbconvert URL (UI:R); kernel RCE crosses a trust boundary so S:C with full C/I/A impact.
Primary rating from Vendor (https://github.com/jupyter-server/jupyter_server).
CVSS VectorVendor: https://github.com/jupyter-server/jupyter_server
Lifecycle Timeline
6DescriptionCVE.org
The nbconvert HTTP handlers in jupyter_server render user-authored notebook HTML under the Jupyter origin without a sandbox directive in their Content-Security-Policy.
Combined with nbconvert.HTMLExporter's default non-sanitizing behavior, a notebook carrying an HTML payload in a display_data output triggers stored XSS with cookie access, full /api/* authority, and kernel RCE.
Impact
An authenticated victim who navigates to /nbconvert/html/<path> containing attacker-authored output can have their token exfiltrated to another domain because it is executed in the Jupyter origin.
Patches
Fixed in v2.20.0, commit 6cbee8d
Workarounds
For deployments where editing the installed jupyter_server is impractical (containerized builds, read-only images), adding this to jupyter_server_config.py has the same effect as the patch above without touching source files:
import jupyter_server.nbconvert.handlers as _nb
def _csp(self):
return super(type(self), self).content_security_policy + "; sandbox allow-scripts"
_nb.NbconvertFileHandler.content_security_policy = property(_csp)
_nb.NbconvertPostHandler.content_security_policy = property(_csp)AnalysisAI
Stored cross-site scripting in jupyter_server's nbconvert HTTP handlers allows a malicious notebook to execute JavaScript in the Jupyter origin, leading to session token theft, full /api/* control, and kernel remote code execution. The NbconvertFileHandler and NbconvertPostHandler render notebook-authored HTML without a CSP sandbox directive, and combined with HTMLExporter's non-sanitizing default, any display_data HTML payload runs with the victim's authority. No public exploit identified at time of analysis, but the CVSS 4.0 base score is 9.3 and a vendor patch is available in v2.20.0.
Technical ContextAI
jupyter_server is the Python backend that powers JupyterLab, Jupyter Notebook 7+, and many derivative data-science environments; the nbconvert handlers expose endpoints like /nbconvert/html/<path> that convert .ipynb files to HTML on the fly via nbconvert.HTMLExporter. CWE-79 (Improper Neutralization of Input During Web Page Generation) applies because the exporter does not sanitize HTML/JS embedded in display_data outputs, and the handlers serve the result under the Jupyter origin with a Content-Security-Policy that lacked the 'sandbox' directive - meaning any embedded script could read cookies (the Jupyter auth token), call /api/* endpoints, and reach the kernel-execution API. The fix introduces a new ServerApp.nbconvert_csp_sandbox boolean (default True) that appends 'sandbox allow-scripts' to the CSP for both NbconvertFileHandler and NbconvertPostHandler, confining rendered notebook JavaScript to a unique opaque origin. Affected package per CPE pkg:pip/jupyter-server covers versions <= 2.19.0.
RemediationAI
Vendor-released patch: upgrade jupyter_server to 2.20.0 or later (pip install --upgrade 'jupyter-server>=2.20.0'), which adds the 'sandbox allow-scripts' directive to the CSP on /nbconvert/ endpoints by default via the new ServerApp.nbconvert_csp_sandbox setting; the change is in commit 6cbee8d (https://github.com/jupyter-server/jupyter_server/commit/6cbee8d65e71abac851c4492fea987ad080580bd) and documented in advisory GHSA-fcw5-x6j4-ccmp. For containerized or read-only deployments where upgrading is impractical, the vendor-supplied workaround is to monkey-patch the handlers in jupyter_server_config.py by setting NbconvertFileHandler.content_security_policy and NbconvertPostHandler.content_security_policy to a property that appends '; sandbox allow-scripts' to the inherited CSP, which produces the same defense without modifying installed source. As a compensating control, operators of multi-user environments can also disable or proxy-strip the /nbconvert/html/ and /nbconvert/ POST endpoints at a reverse proxy (trade-off: users lose in-server HTML export and must download .ipynb files for local conversion), and should advise users not to open untrusted notebooks via nbconvert until patched.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today