VulnSocial

CVE-2026-44727Disclosure(jupyter / jupyter_server)

LOWCVSS 5.4 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch jupyter jupyter_server systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Jupyter Server is the backend for Jupyter web applications. Prior to 2.20, the nbconvert HTTP handlers in jupyter_server render user-authored notebook HTML under the Jupyter origin without a sandbox directive in their Content-Security-Policy. Combined with nbconvert.HTMLExporter's default non-sanitizing behavior, a notebook carrying an HTML payload in a display_data output triggers stored XSS with cookie access, full /api/* authority, and kernel RCE. This vulnerability is fixed in 2.20.

jupyter CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Patch / fix
Other references
Weakness type (CWE)
CWE-79CWE-1021

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • jupyter_server

Threat summary

  • Patch or workaround signal is available
  • 1 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Affected systems

Vendors
jupyter
Products
jupyter_server

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-06-18: 1Patch / Workaround · 2026-06-18: 1Technical Details · 2026-06-18: 106-18
Signal classification1 categories
Disclosure
1100.0%
Full discourse1 post
  • Upwind Security MDR@UpwindMDR
    Disclosure

    🚨 Critical - Jupyter Server Stored XSS in nbconvert Handlers (CVE-2026-44727) Missing sandbox directive in Content-Security-Policy in NbconvertFileHandler / NbconvertPostHandler allows stored XSS when rendering user-authored notebook HTML. An authenticated attacker can achieve full session takeover, token exfiltration, and kernel RCE. 👉Affected: jupyter-server <= 2.19.0 Fixed in: 2.20.0 recommend upgrading.

    Post summary

    CVE‑2026‑44727 is a stored XSS vulnerability in Jupyter Server’s nbconvert handlers that can lead to session takeover and kernel RCE, and it has been fixed in version 2.20.0.

    1000055
    219 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appjupyterjupyter_server---

Explore more

Back to dashboardjupyter CVEsjupyter_server vulnerabilities