CVE-2026-44727: Jupyter Server Stored XSS Vulnerability via Nbconvert Handlers
Summary
CVE-2026-44727: The nbconvert HTTP handlers in jupyter_server render user-authored notebook HTML under the Jupyter origin without a sandbox directive in their Content-Security-Policy. Affects jupyter-server versions < 2.20.0. Fixed in 2.20.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jupyter Server is an open-source web application that allows users to create and share documents that contain live code, equations, visualizations, and narrative text. It is widely used in data science and academic research for its interactive computing capabilities. However, a critical vulnerability has been identified in the nbconvert HTTP handlers, which can lead to stored cross-site scripting (XSS) attacks due to improper handling of user-authored notebook HTML.
Vulnerability Detail
The vulnerability arises from the nbconvert HTTP handlers in Jupyter Server rendering user-authored notebook HTML without a sandbox directive in their Content-Security-Policy (CSP). This oversight, combined with the default non-sanitizing behavior of nbconvert.HTMLExporter, allows an attacker to embed malicious HTML payloads in a notebook. When an authenticated user accesses a notebook with such payloads, it can lead to cookie exfiltration and unauthorized access to the Jupyter API, potentially allowing remote code execution (RCE) on the server.
How To Fix
Latest published version: 2.21.1 as of 23 Oct 2026
pip install --upgrade "jupyter-server==2.21.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.20.0
This is the first release that contains the fix.
pip install --upgrade "jupyter-server==2.20.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not feasible, you can implement the following workaround in your jupyter_server_config.py file to add the sandbox directive without modifying the source code:
import jupyter_server.nbconvert.handlers as _nb
def _csp(self):
return super(type(self), self).content_security_policy + "; sandbox allow-scripts"
_nb.NbconvertFileHandler.content_security_policy = property(_csp)
_nb.NbconvertPostHandler.content_security_policy = property(_csp)
Conclusion
The CVE-2026-44727 vulnerability in Jupyter Server poses a significant risk due to stored XSS attacks enabled by improper handling of notebook HTML. Users are strongly advised to update to the patched version or implement the provided workaround to secure their applications.
See every vulnerability recorded for jupyter-server →
FAQ
The CVSS score of this vulnerability is 9.3, indicating a critical level of risk.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
An attacker can exploit this vulnerability to exfiltrate cookies, gain unauthorized access to the Jupyter API, and execute arbitrary code on the server.
Yes, the vulnerability has been patched in version 2.20.0 of jupyter-server. It is recommended to update to this version.
The XSS attack is stored, meaning that the malicious payload is saved in the notebook and executed when an authenticated user accesses it, leading to potential data theft and server compromise.
References
Related vulnerabilities
Recent vulnerabilities recorded for jupyter-server.
