CVE-2026-44727: Jupyter Server: Stored XSS in `NbconvertFileHandler` / `NbconvertPostHandler` via missing `sandbox` CSP
Jupyter Server is the backend for Jupyter web applications. Prior to 2.20, the nbconvert HTTP handlers in jupyterserver render user-authored notebook HTML under the Jupyter origin without a sandbox directive in their Content-Security-Policy. Combined with nbconvert.HTMLExporter's default non-sanitizing behavior, a notebook carrying an HTML payload in a displaydata output triggers stored XSS with cookie access, full /api/ authority, and kernel RCE. This vulnerability is fixed in 2.20.
Other sources
The nbconvert HTTP handlers in jupyterserver render user-authored notebook HTML under the Jupyter origin without a sandbox directive in their Content-Security-Policy.
Combined with nbconvert.HTMLExporter's default non-sanitizing behavior, a notebook carrying an HTML payload in a displaydata output triggers stored XSS with cookie access, full /api/ authority, and kernel RCE.
Impact
An authenticated victim who navigates to /nbconvert/html/<path> containing attacker-authored output can have their token exfiltrated to another domain because it is executed in the Jupyter origin.
Patches
Fixed in v2.20.0, commit 6cbee8d
Workarounds
For deployments where editing the installed jupyterserver is impractical (containerized builds, read-only images), adding this to jupyterserverconfig.py has the same effect as the patch above without touching source files:
import jupyterserver.nbconvert.handlers as nb
def csp(self): return super(type(self), self).contentsecuritypolicy + "; sandbox allow-scripts"
nb.NbconvertFileHandler.contentsecuritypolicy = property(csp) nb.NbconvertPostHandler.contentsecuritypolicy = property(csp)
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/jupyter-serverto a version that resolves this vulnerability.Fixed in 2.20.0 - Upgrade
Upgrade
jupyter_serverto a version that resolves this vulnerability.Fixed in 2.20.0Patch 6cbee8d - Configuration
In jupyter_server_config.py, set NbconvertFileHandler.content_security_policy (property backed by _csp) to append "; sandbox allow-scripts" to the existing Content-Security-Policy so nbconvert-rendered HTML is sandboxed.
jupyter_server.nbconvert.handlers.NbconvertFileHandler content_security_policy (via _csp) = super(type(self), self).content_security_policy + "; sandbox allow-scripts" - Configuration
In jupyter_server_config.py, set NbconvertPostHandler.content_security_policy (property backed by _csp) to append "; sandbox allow-scripts" to the existing Content-Security-Policy so nbconvert-rendered HTML is sandboxed.
jupyter_server.nbconvert.handlers.NbconvertPostHandler content_security_policy (via _csp) = super(type(self), self).content_security_policy + "; sandbox allow-scripts"
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44727?
The severity of CVE-2026-44727 is rated at 77, indicating a high risk vulnerability.
How do I fix CVE-2026-44727?
To fix CVE-2026-44727, ensure that your Jupyter server is updated to the latest version where the issue is resolved.
What type of vulnerability is CVE-2026-44727?
CVE-2026-44727 is an XSS (Cross-Site Scripting) vulnerability affecting the nbconvert HTTP handlers in jupyter_server.
What components are affected by CVE-2026-44727?
CVE-2026-44727 affects the nbconvert functionality and HTTP handlers in the Jupyter server software.
Are there any known exploits for CVE-2026-44727?
As of now, there are no specific known exploits publicly disclosed for CVE-2026-44727.