More information about this security flaw is available in the following bug: https://bugzilla.redhat.com/show_bug.cgi?id=2326998 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Trying to access bug 2326998 gives me a "not authorized" message. It doesn't do much good to tell me there is a bug, but the details are in some other bug I can't look at, eh?
According to https://nvd.nist.gov/vuln/detail/cve-2023-44270, this bug affects versions of PostCSS before 8.4.31. The current builds of python-nbdime in Fedora 40, 41, and 42 use PostCSS 8.4.45, so are presumably unaffected.