Jupyter Server: notebook HTML rendered without CSP sandbox gives stored XSS and kernel RCE

Impact

The nbconvert handlers render user-authored notebook HTML under the Jupyter origin with no sandbox directive, and nbconvert's HTMLExporter does not sanitize by default. A notebook carrying an HTML payload in a display_data output therefore runs script with the victim's Jupyter cookies and full authority over /api/*, which includes starting kernels - meaning code execution on the machine the notebook server runs on. On a GPU fleet that machine is a GPU node or a shared notebook host, so a shared or downloaded notebook becomes a route into someone else's session and onto the accelerator. Red Hat ships the fix for OpenShift AI, so managed AI platforms are in the blast radius too.

Who can reach it

An attacker who can get a victim to open or preview a notebook file they authored - shared storage, a git repo, a downloaded example. The victim must be authenticated to the Jupyter server and must open the notebook; the attacker needs no account on the server itself.

What to do

Upgrade jupyter_server to 2.20 and restart the notebook server processes; on OpenShift AI apply RHSA-2026:43038 / RHSA-2026:60520 and restart the affected workbench pods. This is a service restart per notebook server - it kills running kernels and any in-flight training in them, but needs no node drain or reboot.

References

Related entries

• OpenMed: unauthenticated model_name routes to a trust_remote_code loader and executes attacker codeCVE-2026-47117 · OpenMed privacy-filter model loader (model_name dispatcher, trust_remote_code=True path)Critical
• MLflow: unauthenticated webhook test follows redirects, turning the tracking server into an SSRF proxyCVE-2026-64849 · MLflow tracking server (webhook test endpoint, /api/2.0/mlflow/webhooks/{id}/test)Critical
• LMDeploy: unauthenticated p2p endpoints let a remote peer deliver a pickle payload for engine RCECVE-2026-76850 · LMDeploy (disaggregated serving ZMQ peer channel)Critical
• Headroom: client-supplied x-headroom-user-id header is trusted as identity, exposing other users' memoryCVE-2026-77776 · Headroom LLM proxy (x-headroom-user-id header treated as identity)Critical
• llama.cpp: use-after-free in the RPC server GRAPH_RECOMPUTE handler gives unauthenticated RCECVE-2026-39909 · llama.cpp RPC server (GRAPH_RECOMPUTE handler)Critical
• Ray (`/log_proxy`): SSRF from the dashboardCVE-2023-48023 · Ray (`/log_proxy`)Critical