Vulnerability GHSA-9754-6rhw-gj3h
Medium Risk
MEDIUM RISK
CVSS Score: 5.4
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
4 months ago
June 26, 2026 at 12:30 PM UTC
jupyter/nbconvert allows Cross-site Scripting (XSS) via unsanitized `text/vnd.mermaid` output in HTML exports
0.0.0 and 4.0.0 - 5.0.0b1 and 5.0.0 - 5.1.1 and 5.2.1 - 5.4.0 and 5.4.1.dev0 and 5.4.1 - 6.0.0a0 and 6.0.0a1 and 6.0.0a2 and 6.0.0a3 and 6.0.0a4 and 6.0.0a5 and 6.0.0a6 and 6.0.0b7 and 6.0.0rc0 and 6.0.0 - 6.1.0rc0 and 6.1.0 - 6.2.0rc0 and 6.2.0rc1 and 6.2.0rc2 and 6.2.0 - 6.3.0b0 and 6.3.0 - 7.0.0rc0 and 7.0.0rc1 and 7.0.0rc2 and 7.0.0rc3 and 7.0.0 - 7.17.0
0.0.0 and 4.0.0 - 5.0.0b1 and 5.0.0 - 5.1.1 and 5.2.1 - 5.4.0 and 5.4.1.dev0 and 5.4.1 - 6.0.0a0 and 6.0.0a1 and 6.0.0a2 and 6.0.0a3 and 6.0.0a4 and 6.0.0a5 and 6.0.0a6 and 6.0.0b7 and 6.0.0rc0 and 6.0.0 - 6.1.0rc0 and 6.1.0 - 6.2.0rc0 and 6.2.0rc1 and 6.2.0rc2 and 6.2.0 - 6.3.0b0 and 6.3.0 - 7.0.0rc0 and 7.0.0rc1 and 7.0.0rc2 and 7.0.0rc3 and 7.0.0 - 7.17.0
Summary
jupyter/nbconvert allows Cross-site Scripting (XSS) via unsanitized `text/vnd.mermaid` output in HTML exports
Details
A vulnerability in jupyter/nbconvert versions <= 7.17.0 allows for Cross-site Scripting (XSS) via unsanitized text/vnd.mermaid output in HTML exports. The data_mermaid block in share/templates/lab/base.html.j2 renders text/vnd.mermaid cell output directly into HTML without escaping, enabling attackers to inject arbitrary HTML/JavaScript by breaking out of the <pre> tag. This vulnerability impacts any server using nbconvert to render notebooks as HTML, allowing attackers to execute arbitrary JavaScript in the context of users viewing the HTML export.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
15 days ago
nbconvert: Arbitrary file write through path traversal in cell output filenames when exporting to md, latex, rst and asciidoc
5.4.0 and 5.4.1.dev0 and 5.4.1 - 6.0.0a0 and 6.0.0a1 and 6.0.0a2 and 6.0.0a3 and 6.0.0a4 and 6.0.0a5 and 6.0.0a6 and 6.0.0b7 and 6.0.0rc0 and 6.0.0 - 6.1.0rc0 and 6.1.0 - 6.2.0rc0 and 6.2.0rc1 and 6.2.0rc2 and 6.2.0 - 6.3.0b0 and 6.3.0 - 7.0.0rc0 and 7.0.0rc1 and 7.0.0rc2 and 7.0.0rc3 and 7.0.0 - 7.17.1 GHSA-pjvx-prjx-h659
5.4.0 and 5.4.1.dev0 and 5.4.1 - 6.0.0a0 and 6.0.0a1 and 6.0.0a2 and 6.0.0a3 and 6.0.0a4 and 6.0.0a5 and 6.0.0a6 and 6.0.0b7 and 6.0.0rc0 and 6.0.0 - 6.1.0rc0 and 6.1.0 - 6.2.0rc0 and 6.2.0rc1 and 6.2.0rc2 and 6.2.0 - 6.3.0b0 and 6.3.0 - 7.0.0rc0 and 7.0.0rc1 and 7.0.0rc2 and 7.0.0rc3 and 7.0.0 - 7.17.1 GHSA-pjvx-prjx-h659
Unknown
4 months ago
nbconvert has an uncontrolled search path that leads to unauthorized code execution on Windows
0.0.0 and 4.0.0 - 5.0.0b1 and 5.0.0 - 5.1.1 and 5.2.1 - 5.4.0 and 5.4.1.dev0 and 5.4.1 - 6.0.0a0 and 6.0.0a1 and 6.0.0a2 and 6.0.0a3 and 6.0.0a4 and 6.0.0a5 and 6.0.0a6 and 6.0.0b7 and 6.0.0rc0 and 6.0.0 - 6.1.0rc0 and 6.1.0 - 6.2.0rc0 and 6.2.0rc1 and 6.2.0rc2 and 6.2.0 - 6.3.0b0 and 6.3.0 - 7.0.0rc0 and 7.0.0rc1 and 7.0.0rc2 and 7.0.0rc3 and 7.0.0 - 7.16.6 PYSEC-2026-1691
0.0.0 and 4.0.0 - 5.0.0b1 and 5.0.0 - 5.1.1 and 5.2.1 - 5.4.0 and 5.4.1.dev0 and 5.4.1 - 6.0.0a0 and 6.0.0a1 and 6.0.0a2 and 6.0.0a3 and 6.0.0a4 and 6.0.0a5 and 6.0.0a6 and 6.0.0b7 and 6.0.0rc0 and 6.0.0 - 6.1.0rc0 and 6.1.0 - 6.2.0rc0 and 6.2.0rc1 and 6.2.0rc2 and 6.2.0 - 6.3.0b0 and 6.3.0 - 7.0.0rc0 and 7.0.0rc1 and 7.0.0rc2 and 7.0.0rc3 and 7.0.0 - 7.16.6 PYSEC-2026-1691
Medium Risk
6 months ago
nbconvert has an Arbitrary File Read via Path Traversal in HTMLExporter Image Embedding
6.5.0 - 7.0.0rc0 and 7.0.0rc1 and 7.0.0rc2 and 7.0.0rc3 and 7.0.0 - 7.17.0 GHSA-7jqv-fw35-gmx9
6.5.0 - 7.0.0rc0 and 7.0.0rc1 and 7.0.0rc2 and 7.0.0rc3 and 7.0.0 - 7.17.0 GHSA-7jqv-fw35-gmx9
Medium Risk
6 months ago
nbconvert has an Arbitrary File Write via Path Traversal in Cell Attachment Filenames
6.5.0 - 7.0.0rc0 and 7.0.0rc1 and 7.0.0rc2 and 7.0.0rc3 and 7.0.0 - 7.17.0 GHSA-4c99-qj7h-p3vg
6.5.0 - 7.0.0rc0 and 7.0.0rc1 and 7.0.0rc2 and 7.0.0rc3 and 7.0.0 - 7.17.0 GHSA-4c99-qj7h-p3vg
Medium Risk
6 months ago
No summary available
6.5.0 - 7.0.0rc0 and 7.0.0rc1 and 7.0.0rc2 and 7.0.0rc3 and 7.0.0 - 7.17.0 PYSEC-2026-2230
6.5.0 - 7.0.0rc0 and 7.0.0rc1 and 7.0.0rc2 and 7.0.0rc3 and 7.0.0 - 7.17.0 PYSEC-2026-2230
Impacted packages
Timeline
Published
4 months ago
June 26, 2026 at 12:30 PM UTC
Last Modified
2 hours ago
November 06, 2026 at 06:00 PM UTC