https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T21:18:01.752107+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-330510 EUVD-2026-330510 2026-10-02T21:18:01.829676+00:00 EUVD-2026-330510 https://cve.radiocsirt.org/vuln/fkie_cve-2026-6658 fkie_cve-2026-6658 2026-10-02T21:18:01.829719+00:00

A vulnerability in jupyter/nbconvert versions <= 7.17.0 allows for Cross-site Scripting (XSS) via unsanitized `text/vnd.mermaid` output in HTML exports. The `data_mermaid` block in `share/templates/lab/base.html.j2` renders `text/vnd.mermaid` cell output directly into HTML without escaping, enabling attackers to inject arbitrary HTML/JavaScript by breaking out of the `<pre>` tag. This vulnerability impacts any server using nbconvert to render notebooks as HTML, allowing attackers to execute arbitrary JavaScript in the context of users viewing the HTML export.

 https://cve.radiocsirt.org/vuln/ghsa-9754-6rhw-gj3h GHSA-9754-6rhw-gj3h 2026-10-02T21:18:01.829766+00:00

A vulnerability in jupyter/nbconvert versions <= 7.17.0 allows for Cross-site Scripting (XSS) via unsanitized `text/vnd.mermaid` output in HTML exports. The `data_mermaid` block in `share/templates/lab/base.html.j2` renders `text/vnd.mermaid` cell output directly into HTML without escaping, enabling attackers to inject arbitrary HTML/JavaScript by breaking out of the `<pre>` tag. This vulnerability impacts any server using nbconvert to render notebooks as HTML, allowing attackers to execute arbitrary JavaScript in the context of users viewing the HTML export.

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11725-1 openSUSE-SU-2026:11725-1 — jupyter-nbconvert-7.17.1-2.1 on GA media 2026-10-02T21:18:01.829788+00:00

jupyter-nbconvert-7.17.1-2.1 on GA media

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-6658 UBUNTU-CVE-2026-6658 2026-10-02T21:18:01.829807+00:00

Affected: Ubuntu:18.04:LTS: nbconvert, Ubuntu:20.04:LTS: nbconvert, Ubuntu:22.04:LTS: nbconvert, Ubuntu:24.04:LTS: nbconvert, Ubuntu:25.10: nbconvert, Ubuntu:26.04:LTS: nbconvert

A vulnerability in jupyter/nbconvert versions <= 7.17.0 allows for Cross-site Scripting (XSS) via unsanitized `text/vnd.mermaid` output in HTML exports. The `data_mermaid` block in `share/templates/lab/base.html.j2` renders `text/vnd.mermaid` cell output directly into HTML without escaping, enabling attackers to inject arbitrary HTML/JavaScript by breaking out of the `<pre>` tag. This vulnerability impacts any server using nbconvert to render notebooks as HTML, allowing attackers to execute arbitrary JavaScript in the context of users viewing the HTML export.