Veille CVE

Lundi 22 juin 2026

1 CVE

Critique 0 Élevée 0 Moyenne 1 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « kernel » ✕
  1. CVE-2026-44727 5.4 Moyenne

    jupyter-server jupyter_server · Red Hat Migration Toolkit for Applications 8.2 · Red Hat OpenShift AI 3.4 · Red Hat OpenShift AI (RHOAI)

    Jupyter Server is the backend for Jupyter web applications. Prior to 2.20, the nbconvert HTTP handlers in jupyter_server render user-authored notebook HTML under the Jupyter origin without a sandbox directive in their Content-Security-Policy. Combined with nbconvert.HTMLExporter's default non-sanitizing behavior, a notebook carrying an HTML payload in a display_data output triggers stored XSS with cookie access, full /api/* authority, and kernel RCE. This vulnerability is fixed in 2.20.