Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A vulnerability in jupyter/nbconvert versions <= 7.17.0 allows for Cross-site Scripting (XSS) via unsanitized `text/vnd.mermaid` output in HTML exports. The `data_mermaid` block in `share/templates/lab/base.html.j2` renders `text/vnd.mermaid` cell output directly into HTML without escaping, enabling attackers to inject arbitrary HTML/JavaScript by breaking out of the `<pre>` tag. This vulnerability impacts any server using nbconvert to render notebooks as HTML, allowing attackers to execute arbitrary JavaScript in the context of users viewing the HTML export.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-6658 A vulnerability in jupyter/nbconvert versions <= 7.17.0 allows for Cross-site Scripting (XSS) via unsanitized `text/vnd.mermaid` output in HTML exports. The `data_merma… https://www.cve.org/CVERecord?id=CVE-2026-6658
Post summary
A new XSS flaw (CVE-2026-6658) has been disclosed in jupyter/nbconvert <=7.17.0 due to unsanitized mermaid output in HTML exports; no exploits, patches, or active usage are reported.
🚨*CVE* CVE-2026-6658 A vulnerability in jupyter/nbconvert versions <= 7.17.0 allows for Cross-site Scripting (XSS) via unsanitized `text/vnd.mermaid` output in HTML exports. The `data_merma… https://www.cve.org/CVERecord?id=CVE-2026-6658 ----- Traducción: CVE-2026-6658 Una… http://infoflow.cloud`
Post summary
CVE‑2026‑6658 is a cross‑site scripting flaw in jupyter/nbconvert up to version 7.17.0 caused by unsanitized Mermaid output in HTML exports. The announcement provides technical details but no PoC, exploit, patch, or report of active exploitation.
CVE-2026-6658 Cross-Site Scripting in Jupyter nbconvert Versions 7.17.0 and Below https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-6658
Post summary
The post identifies a Cross‑Site Scripting vulnerability (CVE‑2026‑6658) affecting Jupyter nbconvert 7.17.0 and earlier, but it provides no PoC, exploit, patch, or evidence of active exploitation.