CVE-2026-6658 Overview
CVE-2026-6658 is a stored Cross-Site Scripting (XSS) vulnerability in jupyter/nbconvert versions <= 7.17.0. The flaw exists in the data_mermaid block within share/templates/lab/base.html.j2, which renders text/vnd.mermaid cell output directly into HTML without escaping. Attackers can craft notebook cells that break out of the enclosing <pre> tag and inject arbitrary HTML or JavaScript. Any server or workflow that uses nbconvert to render Jupyter notebooks as HTML is affected. The injected script executes in the browser context of any user viewing the exported HTML, enabling session theft, phishing, and further client-side attacks [CWE-79].
Critical Impact
Attackers can execute arbitrary JavaScript in the browsers of users viewing HTML exports generated by nbconvert, enabling session hijacking and content manipulation.
Affected Products
- jupyter/nbconvert versions <= 7.17.0
- Jupyter environments and platforms that use nbconvert to render notebooks as HTML
- Downstream services publishing shared or hosted notebook HTML exports
Discovery Timeline
- 2026-06-26 - CVE-2026-6658 published to NVD
- 2026-06-26 - Last updated in NVD database
Technical Details for CVE-2026-6658
Vulnerability Analysis
The vulnerability resides in the Jinja2 template share/templates/lab/base.html.j2 used by nbconvert when producing HTML output. The data_mermaid block emits the text/vnd.mermaid MIME output of a notebook cell into the resulting HTML document. Because the template writes the value without applying HTML escaping, any characters that carry meaning in HTML, such as <, >, and quotes, pass through unchanged.
Exports occur in a <pre> container intended to display raw Mermaid diagram source. An attacker who controls a notebook can place a payload in a cell producing text/vnd.mermaid output that closes the <pre> element and appends attacker-controlled markup. The rendered HTML then contains attacker-supplied <script> or event-handler content that executes when a victim opens the file in a browser.
Root Cause
The root cause is missing output encoding in the data_mermaid template block. The template trusts cell output data as safe HTML rather than treating it as untrusted text. Combined with Jinja2's autoescape not being applied to this specific expression, the raw cell output is written directly into the DOM.
Attack Vector
Exploitation requires an attacker to author or modify a Jupyter notebook and have a victim convert it to HTML using nbconvert, or to view an HTML export produced from such a notebook. User interaction is required, and the attack scope changes because injected script runs in the domain hosting the exported HTML. The primary impact is confidentiality and integrity loss for users viewing the rendered notebook.
The vulnerability manifests when a notebook cell emits text/vnd.mermaid output containing HTML control characters. Because the template writes this value verbatim inside a <pre> element, a payload can terminate the tag and inject a new <script> block or event-handler attribute. See the Huntr bounty listing for the full technical breakdown.
Detection Methods for CVE-2026-6658
Indicators of Compromise
- Notebook cells producing text/vnd.mermaid output that contain the substrings </pre>, <script, or inline event handlers such as onerror= and onload=.
- HTML exports from nbconvert that include unexpected <script> elements outside the standard nbconvert template scaffolding.
- Access logs showing outbound requests from browsers viewing exported notebook HTML to unfamiliar external domains.
Detection Strategies
- Scan .ipynb files for cell outputs with the MIME type text/vnd.mermaid and inspect the payload for HTML metacharacters.
- Diff generated HTML exports against a known-good rendering of the same notebook to flag injected markup.
- Use static analysis or content security policy (CSP) violation reports on web servers hosting exports to identify inline script execution.
Monitoring Recommendations
- Alert on new or modified notebooks uploaded to shared repositories that contain text/vnd.mermaid outputs.
- Monitor browser telemetry and web proxy logs for anomalous script execution or callbacks originating from rendered notebook domains.
- Track nbconvert version usage across build pipelines and continuous integration systems to identify hosts still running vulnerable releases.
How to Mitigate CVE-2026-6658
Immediate Actions Required
- Upgrade jupyter/nbconvert to a version above 7.17.0 once a fixed release is available from the maintainers.
- Treat all third-party notebooks as untrusted input and review cell outputs before conversion.
- Restrict who can publish HTML exports to shared or public-facing web servers.
Patch Information
Refer to the Huntr bounty listing for the current remediation status and any fix commits from the jupyter/nbconvert maintainers. Apply vendor-supplied patches to the data_mermaid block in share/templates/lab/base.html.j2 that add HTML escaping around cell output.
Workarounds
- Strip or sanitize text/vnd.mermaid outputs from notebooks prior to running nbconvert, for example by clearing outputs with jupyter nbconvert --clear-output.
- Serve exported HTML with a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
- Render notebooks in isolated sandbox domains separate from applications holding sensitive session cookies.
# Configuration example: clear notebook outputs before HTML export
jupyter nbconvert --clear-output --inplace untrusted_notebook.ipynb
jupyter nbconvert --to html untrusted_notebook.ipynb
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
