CVE-2026-6658Medium· 5.4▾ Sunlitjupyter/nbconvert allows Cross-site Scripting (XSS) via unsanitized `text/vnd.mermaid` output in HTML exports
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Nov 6.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.2%
A vulnerability in jupyter/nbconvert versions <= 7.17.0 allows for Cross-site Scripting (XSS) via unsanitized text/vnd.mermaid output in HTML exports. The data_mermaid block in share/templates/lab/base.html.j2 renders text/vnd.mermaid cell output directly into HTML without escaping, enabling attackers to inject arbitrary HTML/JavaScript by breaking out of the <pre> tag. This vulnerability impacts any server using nbconvert to render notebooks as HTML, allowing attackers to execute arbitrary JavaScript in the context of users viewing the HTML export.
nbconvert <= 7.17.0Refer to the advisory for the patched release.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114140High· 8.8nbconvert: File write via path traversal in cell output filenames
CVE-2021-32862Medium· 5.4nbconvert vulnerable to cross-site scripting (XSS) via multiple exploit paths
CVE-2026-39378Medium· 6.5nbconvert has an Arbitrary File Read via Path Traversal in HTMLExporter Image Embedding
CVE-2026-39377Medium· 6.5nbconvert has an Arbitrary File Write via Path Traversal in Cell Attachment Filenames
CVE-2025-53000Highnbconvert has an uncontrolled search path that leads to unauthorized code execution on Windows
CVE-2019-1973Medium· 4.8A vulnerability in the web portal framework of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface