CVE-2026-6658

Name	CVE-2026-6658
Description	A vulnerability in jupyter/nbconvert versions <= 7.17.0 allows for Cross-site Scripting (XSS) via unsanitized `text/vnd.mermaid` output in HTML exports. The `data_mermaid` block in `share/templates/lab/base.html.j2` renders `text/vnd.mermaid` cell output directly into HTML without escaping, enabling attackers to inject arbitrary HTML/JavaScript by breaking out of the `<pre>` tag. This vulnerability impacts any server using nbconvert to render notebooks as HTML, allowing attackers to execute arbitrary JavaScript in the context of users viewing the HTML export.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
nbconvert (PTS)	bullseye	5.6.1-3	vulnerable
	bullseye (security)	5.6.1-3+deb11u1	vulnerable
	bookworm	6.5.3-3	vulnerable
	trixie	7.16.6-1	vulnerable
	forky, sid	7.17.1-2	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
nbconvert	source	(unstable)	(unfixed)

https://huntr.com/bounties/47570290-3b26-4477-8cfa-fdef7db5aefe