Bug 2493377 (CVE-2026-6658)

Summary: CVE-2026-6658 nbconvert: nbconvert: Cross-site Scripting via unsanitized Mermaid output in HTML exports
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: anthomas, ehelms, ggainey, jkoehler, jpasqual, juwatts, lphiri, mhulan, nmoumoul, osousa, pcreech, rchan, rjohnson, sdawley, smallamp, tmalecek
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in nbconvert. This vulnerability allows a remote attacker to perform Cross-site Scripting (XSS) by injecting arbitrary HTML or JavaScript code. This occurs due to unsanitized `text/vnd.mermaid` output in HTML exports, where the `data_mermaid` block directly renders cell output without proper escaping. Successful exploitation enables attackers to execute arbitrary JavaScript in the context of users viewing the exported HTML notebooks.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-06-26 10:01:11 UTC
A vulnerability in jupyter/nbconvert versions <= 7.17.0 allows for Cross-site Scripting (XSS) via unsanitized `text/vnd.mermaid` output in HTML exports. The `data_mermaid` block in `share/templates/lab/base.html.j2` renders `text/vnd.mermaid` cell output directly into HTML without escaping, enabling attackers to inject arbitrary HTML/JavaScript by breaking out of the `<pre>` tag. This vulnerability impacts any server using nbconvert to render notebooks as HTML, allowing attackers to execute arbitrary JavaScript in the context of users viewing the HTML export.