CVE-2026-44727 Jupyter Server: Stored XSS in `NbconvertFileHandler` / `NbconvertPostHandler` via missing `sandbox` CSP
Stored XSS in Jupyter Server allows attackers to execute arbitrary code and take over accounts via malicious notebook outputs.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-44727?
CVE-2026-44727 is a critical cross-site scripting vulnerability in jupyter-server jupyter_server, published on 22 Jun 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Jupyter Server is the backend for Jupyter web applications. Prior to 2.20, the nbconvert HTTP handlers in jupyter_server render user-authored notebook HTML under the Jupyter origin without a sandbox directive in their Content-Security-Policy. Combined with nbconvert.HTMLExporter's default non-sanitizing behavior, a notebook carrying an HTML payload in a display_data output triggers stored XSS with cookie access, full /api/* authority, and kernel RCE. This vulnerability is fixed in 2.20.
Which versions are affected by CVE-2026-44727?
3 open source packages ship an affected version, including jupyter-server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
jupyter-server PyPI | All versions | 2.20.0 |
jupyter-server PyPI | All versions | 2.20.0 |
jupyter-server PyPI | All versions | 2.20.0 |
Linux distribution packages (1)
python-jupyter-server openSUSE:Tumbleweed | All versions | 2.20.0-1.1 |
Products include Jupyter Jupyter Server.
How do I fix CVE-2026-44727?
Upgrade jupyter-server to 2.20.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-44727 being exploited?
There is no known exploitation of CVE-2026-44727 in the wild and no public exploit code.
Other vulnerabilities in jupyter-server jupyter_server
- CVE-2026-35397 jupyter-server path traversal allows access to sibling directories sharing root_dir name prefix
- CVE-2026-40110 jupyter-server CORS origin validation bypass via unanchored regex in allow_origin_pat
- CVE-2026-40934 jupyter-server authentication cookies remain valid after password reset due to static cookie secret
- CVE-2024-35178 Jupyter server on Windows discloses Windows user password hash
- CVE-2022-24757 Sensitive Auth & Cookie data stored in Jupyter server logs
Sources
Also known as CLEANSTART-2026-SY39659, DEBIAN-CVE-2026-44727, GHSA-fcw5-x6j4-ccmp, MINI-j8c7-wwpp-pf9r, OESA-2026-3954, OESA-2026-3955 and 4 more.