---
id: CVE-2026-44727
aliases:
  - GHSA-fcw5-x6j4-ccmp
  - PYSEC-2026-366
title: >-
  Jupyter Server: Stored XSS in `NbconvertFileHandler` / `NbconvertPostHandler`
  via missing `sandbox` CSP 
summary: >-
  Jupyter Server: Stored XSS in `NbconvertFileHandler` / `NbconvertPostHandler`
  via missing `sandbox` CSP 
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'
vendor: jupyter-server
product: jupyter-server
ecosystem: pip
affected:
  - jupyter-server < 2.20.0
patched:
  - jupyter-server 2.20.0
published: '2026-06-18'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:49.418798509Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-fcw5-x6j4-ccmp'
references:
  - url: >-
      https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-fcw5-x6j4-ccmp
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-44727'
  - url: >-
      https://github.com/jupyter-server/jupyter_server/commit/6cbee8d65e71abac851c4492fea987ad080580bd
  - url: 'https://access.redhat.com/errata/RHSA-2026:43038'
  - url: 'https://access.redhat.com/errata/RHSA-2026:60520'
  - url: 'https://access.redhat.com/security/cve/CVE-2026-44727'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2491516'
  - url: 'https://github.com/advisories/GHSA-fcw5-x6j4-ccmp'
  - url: 'https://github.com/jupyter-server/jupyter_server'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/jupyter-server/PYSEC-2026-366.yaml
  - url: 'https://pypi.org/project/jupyter-server'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44727.json
tags:
  - osv
  - pip
  - ghsa
epss: 0.00438
epssPercentile: 0.35373
cwe:
  - CWE-79
  - CWE-1021
ingestedAt: '2026-06-19T03:39:00.809Z'
---

## Overview

The nbconvert HTTP handlers in jupyter_server render user-authored notebook HTML under the Jupyter origin without a sandbox directive in their `Content-Security-Policy`. 

Combined with `nbconvert.HTMLExporter`'s default non-sanitizing behavior, a notebook carrying an HTML payload in a display_data output triggers stored XSS with cookie access, full /api/* authority, and kernel RCE.

### Impact

An authenticated victim who navigates to `/nbconvert/html/<path>` containing attacker-authored output can have their token exfiltrated to another domain because it is executed in the Jupyter origin.

### Patches

Fixed in v2.20.0, commit [6cbee8d](https://github.com/jupyter-server/jupyter_server/commit/6cbee8d65e71abac851c4492fea987ad080580bd)


### Workarounds

For deployments where editing the installed jupyter_server is impractical (containerized builds, read-only images), adding this to jupyter_server_config.py has the same effect as the patch above without touching source files:

```
import jupyter_server.nbconvert.handlers as _nb

def _csp(self):
    return super(type(self), self).content_security_policy + "; sandbox allow-scripts"

_nb.NbconvertFileHandler.content_security_policy = property(_csp)
_nb.NbconvertPostHandler.content_security_policy = property(_csp)
```

## Affected packages

- `jupyter-server < 2.20.0`

## Remediation

Upgrade to a patched release:

- `jupyter-server 2.20.0`