CVE-2026-6658: Cross-Site Scripting in Jupyter nbconvert Mermaid Rendering

Technical summary

The vulnerability exists in the Mermaid diagram rendering pipeline within nbconvert's HTML export templates. Specifically, the `data_mermaid` block in `share/templates/lab/base.html.j2` outputs `text/vnd.mermaid` MIME-type cell content directly into HTML without HTML entity encoding or sanitization. An attacker can break out of the surrounding `<pre>` tag by injecting closing tags and new HTML/JavaScript elements, exploiting the lack of output escaping. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic XSS flaw. The CVSS 3.0 score of 5.4 (MEDIUM) reflects network accessibility, low attack complexity, low-privilege requirement, user interaction dependency, and changed scope with limited confidentiality and integrity impact.

Business impact

Organizations using nbconvert to generate shareable HTML reports, documentation, or exported notebooks face risk of malicious payloads embedded in notebook files. If an attacker can supply or modify a notebook that gets converted and shared (e.g., via collaboration platforms, internal wikis, or data science workflows), viewers may be compromised. This is particularly concerning in environments where notebooks are trusted as analytical artifacts but may originate from external sources or untrusted collaborators. The impact is moderate because exploitation requires both crafted notebook content and user action to view the HTML export, but it affects applications across security boundaries.

Affected systems

All installations of jupyter/nbconvert version 7.17.0 and earlier are vulnerable. The vulnerability applies to any workflow that converts notebooks to HTML format, including command-line nbconvert operations, programmatic usage via the Python API, and integrated conversion features in Jupyter Lab or other frontends. Systems that process or publish user-supplied notebooks as HTML exports are at highest risk. The absence of vendor/product records in the source data suggests this is a direct library vulnerability affecting all downstream consumers of nbconvert.

Exploitability

The vulnerability is exploitable but not trivial. An attacker must craft a Jupyter notebook containing malicious Mermaid diagram syntax (or inject it into an existing notebook), then either convince a user to open the converted HTML or position themselves to convert notebooks that will be viewed. The attack does not require special network access or complex exploit development—basic HTML/JavaScript injection knowledge suffices. However, exploitation is constrained by the need for notebook access and user interaction, preventing automated, large-scale attacks. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of the publication date, suggesting active exploitation has not yet been documented, though the straightforward nature of XSS attacks means exploitation could emerge quickly.

Remediation

Users should upgrade to a version of nbconvert that sanitizes Mermaid diagram output. Verify the specific patched version against the official jupyter/nbconvert release notes and security advisories. As an interim measure, organizations can restrict notebook conversion to trusted sources, disable Mermaid rendering if not essential, or implement output sanitization in downstream applications consuming nbconvert HTML exports. Additionally, security teams should audit notebooks stored in shared repositories or collaboration platforms for suspicious Mermaid content.

Patch guidance

Check the official jupyter/nbconvert GitHub repository and release notes for versions after 7.17.0 that address this XSS flaw. Apply the patch across all systems using nbconvert for HTML export, including CI/CD pipelines that automate notebook conversion. Test patched versions in a staging environment to ensure compatibility with existing workflows before broad deployment. If your organization uses nbconvert through a managed service or integrated tool (such as Jupyter Hub, JupyterLab servers, or data science platforms), verify that those services have updated their nbconvert dependency and apply their recommended updates.

Detection guidance

Monitor nbconvert version deployments and audit system logs for notebook conversion activities. Examine generated HTML files for suspicious script tags, event handlers, or HTML entities that may indicate injection attempts in Mermaid cell outputs. Implement content security policy (CSP) headers in web applications serving converted notebooks to limit XSS impact. Log and review notebooks uploaded or modified by external users before conversion. Consider static analysis of notebook JSON to identify anomalous Mermaid syntax or embedded JavaScript.

Why prioritize this

While the CVSS score is MEDIUM (5.4), prioritization depends on your organization's exposure. Environments that convert user-supplied or externally-sourced notebooks to HTML and share them internally or publicly should prioritize patching promptly, as the attack is straightforward and the scope is changed (cross-domain impact). Conversely, teams using nbconvert only for trusted, internal notebook conversion with restricted viewing may deprioritize relative to critical vulnerabilities. The lack of active exploitation in the wild provides a window to patch before weaponization occurs.

Risk score, explained

The CVSS 3.0 score of 5.4 (MEDIUM) is driven by several factors: Attack Vector Network (accessibility from the internet), Attack Complexity Low (no special conditions required), Privileges Required Low (typical user can craft a notebook), User Interaction Required (victim must view the HTML export), and Scope Changed (impact extends beyond the application, affecting other websites or user sessions if the HTML is embedded or proxied). Confidentiality and Integrity are rated Low because the attacker can read/modify user data in that session context, but there is no impact to Availability. Organizations with high-value data or sensitive user bases may consider this a higher practical risk despite the moderate CVSS rating.

Frequently asked questions