CVE-2026-44727: jupyter-server jupyter_server Cross-site Scripting
Vulnerability summary
CVE-2026-44727 is a critical (CVSS 9.3) Cross-site Scripting vulnerability in jupyter-server jupyter_server. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 36.7% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 22-06-2026PublishedVulnerability first disclosed.
- 28-08-2026Last modifiedVulnerability information updated.
Description
Jupyter Server is the backend for Jupyter web applications. Prior to 2.20, the nbconvert HTTP handlers in jupyter_server render user-authored notebook HTML under the Jupyter origin without a sandbox directive in their Content-Security-Policy. Combined with nbconvert.HTMLExporter's default non-sanitizing behavior, a notebook carrying an HTML payload in a display_data output triggers stored XSS with cookie access, full /api/* authority, and kernel RCE. This vulnerability is fixed in 2.20.
CVSS metrics
9 scores · 6 sources · 2 versions- OSV · PypiEcosystem advisory · calculated9.3CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- OSV · UbuntuEcosystem advisory · calculated9.3CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- OSV · ChainguardEcosystem advisory · calculated9.3CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- NVDNIST9.3CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · UbuntuEcosystem advisory · calculated5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NDiffers
- OSV · DebianEcosystem advisory · calculated5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NDiffers
- NVDNIST5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NDiffers
EPSS trend
Probability
0.44%
Chance of exploitation in the next 30 days
Percentile
37%
Versus all other CVEs
30-day change
0.00 pp
From 0.44% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
- CWE-1021Improper Restriction of Rendered UI Layers or FramesThe web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain.
Affected systems
Chainguard2 products
- tensorflow-cpu-jupyter< 2.21.0-r6
- tensorflow-gpu-jupyter< 2.21.0-r6
Debian1 product
- jupyter-serverAll versions (No fix recorded) | < 2.20.0-1
Jupyter1 product
- jupyter_server< 2.20.0
Jupyter-server1 product
- jupyter_server< 2.20
Opensuse1 product
- python-jupyter-server&distro=openSUSE Tumbleweed< 2.20.0-1.1
PyPI1 product
- jupyter-server< 2.20.0
Ubuntu1 product
- jupyter-serverAll versions (No fix recorded)
7 vendors · 8 products
References
17 links- github.com/jupyter-server/jupyter_server/security/advisories/GHSA-fcw5-x6j4-ccmpX Refsource CONFIRMWEBREPORTAdvisoryMitigationPatchVendor Advisory
- github.com/jupyter-server/jupyter_server/commit/6cbee8d65e71abac851c4492fea987ad080580bdX Refsource MISCWEBREPORTFIXPatch
