https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-19T01:21:32.028994+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2021-32862 CVE-2021-32862 — nbconvert vulnerable to cross-site scripting (XSS) via multiple exploit paths 2026-10-19T01:21:32.071231+00:00

Affected: jupyter nbconvert

The GitHub Security Lab discovered sixteen ways to exploit a cross-site scripting vulnerability in nbconvert. When using nbconvert to generate an HTML version of a user-controllable notebook, it is possible to inject arbitrary HTML which may lead to cross-site scripting (XSS) vulnerabilities if these HTML notebooks are served by a web server (eg: nbviewer).

 https://db.gcve.eu/vuln/ghsa-9jmq-rx5f-8jwq GHSA-9jmq-rx5f-8jwq — nbconvert vulnerable to cross-site scripting (XSS) via multiple exploit paths 2026-10-19T01:21:32.071319+00:00

Affected: PyPI: nbconvert

Most of the fixes will be in this repo, though, so having it here gives us the private fork to work on patches

Below is currently a duplicate of the original report:

----

Received on security@ipython.org unedited, I'm not sure if we want to make it separate advisories.

Pasted raw for now, feel free to edit or make separate advisories if you have the rights to.

I think the most important is to switch back from nbviewer.jupyter.org -> nbviewer.org at the cloudflare level I guess ? There might be fastly involved as well. --- ### Impact _What kind of vulnerability is it? Who is impacted?_

### Patches _Has the problem been patched? What versions should users upgrade to?_

### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_

### References _Are there any links users can visit to find out more?_

### For more information If you have any questions or comments about this advisory: * Open an issue in [example link to repo](http://example.com) * Email us at [example email address](mailto:example@example.com)

---

# GitHub Security Lab (GHSL) Vulnerability Report

The [GitHub Security Lab](https://securitylab.github.com) team has identified potential security vulnerabilities in [nbconvert](https://github.com/jupyter/nbconvert).

We are committed to working with you to help resolve these issues. In this report you will find everything you need to effectively coordinate a resolution of these issues with the GHSL team.

If at any p…

 https://db.gcve.eu/vuln/pysec-2022-249 PYSEC-2022-249 2026-10-19T01:21:32.071466+00:00

Affected: PyPI: nbconvert

The GitHub Security Lab discovered sixteen ways to exploit a cross-site scripting vulnerability in nbconvert. When using nbconvert to generate an HTML version of a user-controllable notebook, it is possible to inject arbitrary HTML which may lead to cross-site scripting (XSS) vulnerabilities if these HTML notebooks are served by a web server (eg: nbviewer).