https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 10:01:46 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-330510 EUVD-2026-330510 https://cve.radiocsirt.org/vuln/euvd-2026-330510 https://cve.radiocsirt.org/vuln/fkie_cve-2026-6658 <p>A vulnerability in jupyter/nbconvert versions &lt;= 7.17.0 allows for Cross-site Scripting (XSS) via unsanitized `text/vnd.mermaid` output in HTML exports. The `data_mermaid` block in `share/templates/lab/base.html.j2` renders `text/vnd.mermaid` cell output directly into HTML without escaping, enabling attackers to inject arbitrary HTML/JavaScript by breaking out of the `&lt;pre&gt;` tag. This vulnerability impacts any server using nbconvert to render notebooks as HTML, allowing attackers to execute arbitrary JavaScript in the context of users viewing the HTML export.</p> <p>A vulnerability in jupyter/nbconvert versions &lt;= 7.17.0 allows for Cross-site Scripting (XSS) via unsanitized `text/vnd.mermaid` output in HTML exports. The `data_mermaid` block in `share/templates/lab/base.html.j2` renders `text/vnd.mermaid` cell output directly into HTML without escaping, enabling attackers to inject arbitrary HTML/JavaScript by breaking out of the `&lt;pre&gt;` tag. This vulnerability impacts any server using nbconvert to render notebooks as HTML, allowing attackers to execute arbitrary JavaScript in the context of users viewing the HTML export.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-6658 https://cve.radiocsirt.org/vuln/ghsa-9754-6rhw-gj3h <p>A vulnerability in jupyter/nbconvert versions &lt;= 7.17.0 allows for Cross-site Scripting (XSS) via unsanitized `text/vnd.mermaid` output in HTML exports. The `data_mermaid` block in `share/templates/lab/base.html.j2` renders `text/vnd.mermaid` cell output directly into HTML without escaping, enabling attackers to inject arbitrary HTML/JavaScript by breaking out of the `&lt;pre&gt;` tag. This vulnerability impacts any server using nbconvert to render notebooks as HTML, allowing attackers to execute arbitrary JavaScript in the context of users viewing the HTML export.</p> <p>A vulnerability in jupyter/nbconvert versions &lt;= 7.17.0 allows for Cross-site Scripting (XSS) via unsanitized `text/vnd.mermaid` output in HTML exports. The `data_mermaid` block in `share/templates/lab/base.html.j2` renders `text/vnd.mermaid` cell output directly into HTML without escaping, enabling attackers to inject arbitrary HTML/JavaScript by breaking out of the `&lt;pre&gt;` tag. This vulnerability impacts any server using nbconvert to render notebooks as HTML, allowing attackers to execute arbitrary JavaScript in the context of users viewing the HTML export.</p> https://cve.radiocsirt.org/vuln/ghsa-9754-6rhw-gj3h https://cve.radiocsirt.org/vuln/opensuse-su-2026:11725-1 <p>jupyter-nbconvert-7.17.1-2.1 on GA media</p> <p>jupyter-nbconvert-7.17.1-2.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11725-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-6658 <p><strong>Affected:</strong> Ubuntu:18.04:LTS: nbconvert, Ubuntu:20.04:LTS: nbconvert, Ubuntu:22.04:LTS: nbconvert, Ubuntu:24.04:LTS: nbconvert, Ubuntu:25.10: nbconvert, Ubuntu:26.04:LTS: nbconvert</p> <p>A vulnerability in jupyter/nbconvert versions &lt;= 7.17.0 allows for Cross-site Scripting (XSS) via unsanitized `text/vnd.mermaid` output in HTML exports. The `data_mermaid` block in `share/templates/lab/base.html.j2` renders `text/vnd.mermaid` cell output directly into HTML without escaping, enabling attackers to inject arbitrary HTML/JavaScript by breaking out of the `&lt;pre&gt;` tag. This vulnerability impacts any server using nbconvert to render notebooks as HTML, allowing attackers to execute arbitrary JavaScript in the context of users viewing the HTML export.</p> <p><strong>Affected:</strong> Ubuntu:18.04:LTS: nbconvert, Ubuntu:20.04:LTS: nbconvert, Ubuntu:22.04:LTS: nbconvert, Ubuntu:24.04:LTS: nbconvert, Ubuntu:25.10: nbconvert, Ubuntu:26.04:LTS: nbconvert</p> <p>A vulnerability in jupyter/nbconvert versions &lt;= 7.17.0 allows for Cross-site Scripting (XSS) via unsanitized `text/vnd.mermaid` output in HTML exports. The `data_mermaid` block in `share/templates/lab/base.html.j2` renders `text/vnd.mermaid` cell output directly into HTML without escaping, enabling attackers to inject arbitrary HTML/JavaScript by breaking out of the `&lt;pre&gt;` tag. This vulnerability impacts any server using nbconvert to render notebooks as HTML, allowing attackers to execute arbitrary JavaScript in the context of users viewing the HTML export.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-6658