{"id":"CVE-2026-44727","aliases":["GHSA-fcw5-x6j4-ccmp","PYSEC-2026-366"],"title":"Jupyter Server: Stored XSS in `NbconvertFileHandler` / `NbconvertPostHandler` via missing `sandbox` CSP ","summary":"Jupyter Server: Stored XSS in `NbconvertFileHandler` / `NbconvertPostHandler` via missing `sandbox` CSP ","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","vendor":"jupyter-server","product":"jupyter-server","ecosystem":"pip","affected":["jupyter-server < 2.20.0"],"patched":["jupyter-server 2.20.0"],"published":"2026-06-18","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:49.418798509Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-fcw5-x6j4-ccmp","references":[{"url":"https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-fcw5-x6j4-ccmp"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44727"},{"url":"https://github.com/jupyter-server/jupyter_server/commit/6cbee8d65e71abac851c4492fea987ad080580bd"},{"url":"https://access.redhat.com/errata/RHSA-2026:43038"},{"url":"https://access.redhat.com/errata/RHSA-2026:60520"},{"url":"https://access.redhat.com/security/cve/CVE-2026-44727"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2491516"},{"url":"https://github.com/advisories/GHSA-fcw5-x6j4-ccmp"},{"url":"https://github.com/jupyter-server/jupyter_server"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/jupyter-server/PYSEC-2026-366.yaml"},{"url":"https://pypi.org/project/jupyter-server"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44727.json"}],"tags":["osv","pip","ghsa"],"epss":0.00438,"epssPercentile":0.37414,"cwe":["CWE-79","CWE-1021"],"ingestedAt":"2026-06-19T03:39:00.809Z","slug":"CVE-2026-44727","body":"## Overview\n\nThe nbconvert HTTP handlers in jupyter_server render user-authored notebook HTML under the Jupyter origin without a sandbox directive in their `Content-Security-Policy`. \n\nCombined with `nbconvert.HTMLExporter`'s default non-sanitizing behavior, a notebook carrying an HTML payload in a display_data output triggers stored XSS with cookie access, full /api/* authority, and kernel RCE.\n\n### Impact\n\nAn authenticated victim who navigates to `/nbconvert/html/<path>` containing attacker-authored output can have their token exfiltrated to another domain because it is executed in the Jupyter origin.\n\n### Patches\n\nFixed in v2.20.0, commit [6cbee8d](https://github.com/jupyter-server/jupyter_server/commit/6cbee8d65e71abac851c4492fea987ad080580bd)\n\n\n### Workarounds\n\nFor deployments where editing the installed jupyter_server is impractical (containerized builds, read-only images), adding this to jupyter_server_config.py has the same effect as the patch above without touching source files:\n\n```\nimport jupyter_server.nbconvert.handlers as _nb\n\ndef _csp(self):\n    return super(type(self), self).content_security_policy + \"; sandbox allow-scripts\"\n\n_nb.NbconvertFileHandler.content_security_policy = property(_csp)\n_nb.NbconvertPostHandler.content_security_policy = property(_csp)\n```\n\n## Affected packages\n\n- `jupyter-server < 2.20.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `jupyter-server 2.20.0`","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":201384,"id":"CVE-2026-44727","ts":1789399323921,"field":"cvss","old":null,"new":"5.4"},{"seq":201383,"id":"CVE-2026-44727","ts":1789399323921,"field":"severity","old":"critical","new":"medium"},{"seq":200127,"id":"CVE-2026-44727","ts":1789396477341,"field":"cvss","old":"5.4","new":null},{"seq":200126,"id":"CVE-2026-44727","ts":1789396477341,"field":"severity","old":"medium","new":"critical"},{"seq":196921,"id":"CVE-2026-44727","ts":1789384201924,"field":"cvss","old":null,"new":"5.4"},{"seq":196920,"id":"CVE-2026-44727","ts":1789384201924,"field":"severity","old":"critical","new":"medium"},{"seq":195850,"id":"CVE-2026-44727","ts":1789383049779,"field":"cvss","old":"5.4","new":null},{"seq":195849,"id":"CVE-2026-44727","ts":1789383049779,"field":"severity","old":"medium","new":"critical"},{"seq":194776,"id":"CVE-2026-44727","ts":1789380173267,"field":"cvss","old":null,"new":"5.4"},{"seq":194775,"id":"CVE-2026-44727","ts":1789380173267,"field":"severity","old":"critical","new":"medium"},{"seq":193566,"id":"CVE-2026-44727","ts":1789377874078,"field":"cvss","old":"5.4","new":null},{"seq":193565,"id":"CVE-2026-44727","ts":1789377874078,"field":"severity","old":"medium","new":"critical"},{"seq":192350,"id":"CVE-2026-44727","ts":1789376081772,"field":"cvss","old":null,"new":"5.4"},{"seq":192349,"id":"CVE-2026-44727","ts":1789376081772,"field":"severity","old":"critical","new":"medium"},{"seq":191140,"id":"CVE-2026-44727","ts":1789372719859,"field":"cvss","old":"5.4","new":null},{"seq":191139,"id":"CVE-2026-44727","ts":1789372719859,"field":"severity","old":"medium","new":"critical"},{"seq":189922,"id":"CVE-2026-44727","ts":1789369015259,"field":"cvss","old":null,"new":"5.4"},{"seq":189921,"id":"CVE-2026-44727","ts":1789369015259,"field":"severity","old":"critical","new":"medium"},{"seq":188712,"id":"CVE-2026-44727","ts":1789367715659,"field":"cvss","old":"5.4","new":null},{"seq":188711,"id":"CVE-2026-44727","ts":1789367715659,"field":"severity","old":"medium","new":"critical"},{"seq":187492,"id":"CVE-2026-44727","ts":1789364862430,"field":"cvss","old":null,"new":"5.4"},{"seq":187491,"id":"CVE-2026-44727","ts":1789364862430,"field":"severity","old":"critical","new":"medium"},{"seq":186282,"id":"CVE-2026-44727","ts":1789362642315,"field":"cvss","old":"5.4","new":null},{"seq":186281,"id":"CVE-2026-44727","ts":1789362642315,"field":"severity","old":"medium","new":"critical"},{"seq":185065,"id":"CVE-2026-44727","ts":1789360838850,"field":"cvss","old":null,"new":"5.4"},{"seq":185064,"id":"CVE-2026-44727","ts":1789360838850,"field":"severity","old":"critical","new":"medium"},{"seq":183855,"id":"CVE-2026-44727","ts":1789357547464,"field":"cvss","old":"5.4","new":null},{"seq":183854,"id":"CVE-2026-44727","ts":1789357547464,"field":"severity","old":"medium","new":"critical"},{"seq":182107,"id":"CVE-2026-44727","ts":1789353978674,"field":"cvss","old":null,"new":"5.4"},{"seq":182106,"id":"CVE-2026-44727","ts":1789353978674,"field":"severity","old":"critical","new":"medium"},{"seq":180900,"id":"CVE-2026-44727","ts":1789352618850,"field":"cvss","old":"5.4","new":null},{"seq":180899,"id":"CVE-2026-44727","ts":1789352618850,"field":"severity","old":"medium","new":"critical"},{"seq":179693,"id":"CVE-2026-44727","ts":1789349812268,"field":"cvss","old":null,"new":"5.4"},{"seq":179692,"id":"CVE-2026-44727","ts":1789349812268,"field":"severity","old":"critical","new":"medium"},{"seq":178486,"id":"CVE-2026-44727","ts":1789347416184,"field":"cvss","old":"5.4","new":null},{"seq":178485,"id":"CVE-2026-44727","ts":1789347416184,"field":"severity","old":"medium","new":"critical"},{"seq":177279,"id":"CVE-2026-44727","ts":1789346035650,"field":"cvss","old":null,"new":"5.4"},{"seq":177278,"id":"CVE-2026-44727","ts":1789346035650,"field":"severity","old":"critical","new":"medium"},{"seq":176072,"id":"CVE-2026-44727","ts":1789342424229,"field":"cvss","old":"5.4","new":null},{"seq":176071,"id":"CVE-2026-44727","ts":1789342424229,"field":"severity","old":"medium","new":"critical"},{"seq":175858,"id":"CVE-2026-44727","ts":1789342045017,"field":"cvss","old":null,"new":"5.4"},{"seq":175857,"id":"CVE-2026-44727","ts":1789342045017,"field":"severity","old":"critical","new":"medium"},{"seq":175396,"id":"CVE-2026-44727","ts":1789337986772,"field":"cvss","old":"5.4","new":null},{"seq":175395,"id":"CVE-2026-44727","ts":1789337986772,"field":"severity","old":"medium","new":"critical"},{"seq":174191,"id":"CVE-2026-44727","ts":1789334467905,"field":"cvss","old":null,"new":"5.4"},{"seq":174190,"id":"CVE-2026-44727","ts":1789334467905,"field":"severity","old":"critical","new":"medium"},{"seq":173005,"id":"CVE-2026-44727","ts":1789332993096,"field":"cvss","old":"5.4","new":null},{"seq":173004,"id":"CVE-2026-44727","ts":1789332993096,"field":"severity","old":"medium","new":"critical"},{"seq":171819,"id":"CVE-2026-44727","ts":1789330797498,"field":"cvss","old":null,"new":"5.4"},{"seq":171818,"id":"CVE-2026-44727","ts":1789330797498,"field":"severity","old":"critical","new":"medium"}]}