CVE-2026-6658

Name of the Vulnerable Software and Affected Versions jupyter/nbconvert versions prior to 7.17.1

Description Cross-site Scripting (XSS) occurs during HTML exports due to unsanitized text/vnd.mermaid output. The data mermaid block in share/templates/lab/base.html.j2 renders this output directly into HTML without escaping, which allows attackers to break out of the <pre> tag and inject arbitrary HTML or JavaScript. This issue affects servers using nbconvert to render notebooks as HTML, enabling the execution of malicious scripts in the context of users viewing the exported file.

Recommendations Update to a version newer than 7.17.0.