CVE-2026-6658

MediumCVSS 5.4/10Last modified Jun 26, 2026

Description

A vulnerability in jupyter/nbconvert versions <= 7.17.0 allows for Cross-site Scripting (XSS) via unsanitized `text/vnd.mermaid` output in HTML exports. The `data_mermaid` block in `share/templates/lab/base.html.j2` renders `text/vnd.mermaid` cell output directly into HTML without escaping, enabling attackers to inject arbitrary HTML/JavaScript by breaking out of the `<pre>` tag. This vulnerability impacts any server using nbconvert to render notebooks as HTML, allowing attackers to execute arbitrary JavaScript in the context of users viewing the HTML export.

Metrics

CVSS 3.0 5.4/10CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jun 26, 2026
Last modified
Jun 26, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-665808.5Contributor SQL Injection in Product Feed Manager <= 7.12.0 versions.CVE-2026-665817.1Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.14.1 versions.CVE-2026-665827.1Unauthenticated Cross Site Scripting (XSS) in TranslatePress <= 3.3.2 versions.CVE-2026-665839.8Unauthenticated PHP Object Injection in Forminator <= 1.57.0 versions.CVE-2026-665847.1Unauthenticated Cross Site Scripting (XSS) in 12 Step Meeting List <= 3.19.16 versions.CVE-2026-665857.5Unauthenticated Sensitive Data Exposure in WP Cafe Pro < 3.0.15 versions.CVE-2026-665866.6Author Local File Inclusion in WP Cafe Pro < 3.0.15 versions.CVE-2026-665879.8Unauthenticated Local File Inclusion in WP Cafe Pro < 3.0.15 versions.CVE-2026-665895.4Missing Authorization vulnerability in Kings Plugins B2BKing allows Exploiting Incorrectly Configured Access Control Security Levels. This CVE-2026-66597.5Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts. The built-in rand function is predictable, and CVE-2026-665907.1Unauthenticated Cross Site Scripting (XSS) in Tagembed <= 7.4 versions.CVE-2026-665916.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant
CVE-2026-6658: Medium severity, CVSS 5.4 | Vulnix