CVE-2026-44727: Jupyter Server: Stored XSS in `NbconvertFileHandler` / `NbconvertPostHandler` via missing `sandbox` CSP

Synopsis

Stored cross-site scripting (XSS) in Jupyter Server affects the nbconvert HTTP handlers (NbconvertFileHandler and NbconvertPostHandler) in jupyter_server versions before 2.20. The vulnerability is reachable over the network by any low-privilege authenticated user, and requires a victim to interact with a crafted notebook; no sandbox directive in the Content-Security-Policy allows injected HTML to run under the full Jupyter origin. Successful exploitation gives an attacker access to session cookies, full /api/* authority, and the ability to execute arbitrary code in running kernels. No fix version has been published yet; HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as an upstream fix ships.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The nbconvert handlers are exposed over the network, so an attacker must be able to reach the Jupyter Server HTTP endpoint across the network to deliver the malicious notebook payload.

• AuthenticationRequired

  A low-privilege account (any valid Jupyter login) is sufficient to submit or store a notebook containing the XSS payload; no admin rights are needed.

• Victim interactionRequired

  A logged-in user must open or render the malicious notebook through the nbconvert handler, making this a social-engineering or shared-workspace attack where the victim is induced to view the crafted content.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no race conditions, specific memory layout, or other environmental prerequisites beyond reaching the service and getting the victim to render the notebook.

Blast Radius

• Reads session cookies tied to the Jupyter origin, allowing the attacker to hijack the victim's authenticated session.
• Exercises full /api/* authority on behalf of the victim, including reading, creating, and deleting notebooks and files.
• Executes arbitrary code inside running Jupyter kernels, giving the attacker a foothold on the underlying host process.
• Propagates impact beyond the directly compromised user context to any shared infrastructure the Jupyter Server can reach (SC:H, SI:H, SA:H in the CVSS v4 vector).