Beveiligingsadvies

CVE-2026-44727

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-06-22 19:56:56

Laatst bijgewerkt 2026-08-28 12:04:25

Toegewezen door GitHub_M

CVSS-score 9.3

Status PUBLISHED

Beschrijving

Jupyter Server is the backend for Jupyter web applications. Prior to 2.20, the nbconvert HTTP handlers in jupyter_server render user-authored notebook HTML under the Jupyter origin without a sandbox directive in their Content-Security-Policy. Combined with nbconvert.HTMLExporter's default non-sanitizing behavior, a notebook carrying an HTML payload in a display_data output triggers stored XSS with cookie access, full /api/* authority, and kernel RCE. This vulnerability is fixed in 2.20.

← Alle CVE's bekijken Bekijk op cve.org ↗