CVE-2026-44727

The nbconvert HTTP handlers in jupyter_server render user-authored notebook HTML under the Jupyter origin without a sandbox directive in their Content-Security-Policy. 

Combined with nbconvert.HTMLExporter's default non-sanitizing behavior, a notebook carrying an HTML payload in a display_data output triggers stored XSS with cookie access, full /api/* authority, and kernel RCE.

Impact

An authenticated victim who navigates to /nbconvert/html/<path> containing attacker-authored output can have their token exfiltrated to another domain because it is executed in the Jupyter origin.

Patches

Fixed in v2.20.0, commit 6cbee8d

​

Workarounds

For deployments where editing the installed jupyterserver is impractical (containerized builds, read-only images), adding this to jupyterserver_config.py has the same effect as the patch above without touching source files:

import jupyter_server.nbconvert.handlers as _nb
def _csp(self):
    return super(type(self), self).content_security_policy + "; sandbox allow-scripts"
_nb.NbconvertFileHandler.content_security_policy = property(_csp)
_nb.NbconvertPostHandler.content_security_policy = property(_csp)