← Vulnerability feed

Vulnerability record · CVE-2026-44727 · published 22 June 2026

CVE-2026-44727: Jupyter server cross-site scripting vulnerability

Jupyter · Jupyter Server

Jupyter Server is the backend for Jupyter web applications. Prior to 2.20, the nbconvert HTTP handlers in jupyter_server render user-authored notebook HTML under the Jupyter origin without a sandbox directive in their Content-Security-Policy. Combined with nbconvert.HTMLExporter's default non-sanitizing behavior, a notebook carrying an HTML payload in a display_data output triggers stored XSS with cookie access, full /api/* authority, and kernel RCE. This vulnerability is fixed in 2.20.

9.3 CVSS 4.0 Critical EPSS 0.44% · top 64.4% CWE-79 · Cross-site scriptingCWE-1021 · Clickjacking
9.3CVSS 4.0 base score
0.44%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
7References
28 Aug 2026Last modified by NVD

Description

Jupyter Server is the backend for Jupyter web applications. Prior to 2.20, the nbconvert HTTP handlers in jupyter_server render user-authored notebook HTML under the Jupyter origin without a sandbox directive in their Content-Security-Policy. Combined with nbconvert.HTMLExporter's default non-sanitizing behavior, a notebook carrying an HTML payload in a display_data output triggers stored XSS with cookie access, full /api/* authority, and kernel RCE. This vulnerability is fixed in 2.20.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/jupyter-server/jupyter_server/commit/6cbee8d65e71abac851c4492fea987ad080580bd Patch
https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-fcw5-x6j4-ccmp MitigationPatchVendor Advisory
https://access.redhat.com/errata/RHSA-2026:43038
https://access.redhat.com/errata/RHSA-2026:60520
https://access.redhat.com/security/cve/CVE-2026-44727
https://bugzilla.redhat.com/show_bug.cgi?id=2491516
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44727.json

Track CVE-2026-44727 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2026-6657Jupyter server origin validation error vulnerabilityA vulnerability in jupyter-server versions 1.12.0 through 2.17.0 allows an attacker to bypass CORS origin validation when the `allow_origin_pat` conf…EPSS 0.27%8.8CVE-2022-29241Jupyter server information exposure vulnerabilityJupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter Notebook. Prior to v…EPSS 0.95%8.1CVE-2026-5422Jupyter server relative path traversal vulnerabilityA path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() functi…EPSS 0.55%7.6CVE-2026-40110Jupyter server vulnerabilityJupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the Origin header validation uses Python's re.match() to …EPSS 0.47%7.6CVE-2026-40934Jupyter server insufficient session expiration vulnerabilityJupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the secret used to sign authentication cookies is persist…EPSS 0.38%7.6CVE-2026-35397Jupyter server path traversal vulnerabilityJupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, a path traversal vulnerability in the REST API allows an …EPSS 0.67%7.5CVE-2024-35178Jupyter server information exposure vulnerabilityThe Jupyter Server provides the backend for Jupyter web applications. Jupyter Server on Windows has a vulnerability that lets unauthenticated attacke…EPSS 0.71%7.5CVE-2022-24757Jupyter server sensitive information in log file vulnerabilityThe Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications. Prior to version 1.15.4, una…EPSS 1.3%

Source: NIST National Vulnerability Database (record CVE-2026-44727), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.