Skip to content
Threat Feed
Subscribe

Tag

Server-Side

2 briefs RSS
critical advisory

Jupyter Server Stored XSS via Missing CSP Sandbox (CVE-2026-44727)

A critical stored Cross-Site Scripting (XSS) vulnerability, CVE-2026-44727, exists in `jupyter_server` versions up to 2.19.0 due to a missing `sandbox` directive in Content-Security-Policy (CSP) headers, allowing authenticated attackers to craft malicious notebooks that exfiltrate victim tokens and achieve kernel Remote Code Execution (RCE) when viewed.

jupyter_server xss web-vulnerability jupyter server-side rce
2r 4t
high advisory

npm PraisonAI SandboxExecutor allowedCommands bypass via shell chaining

A critical command injection vulnerability exists in the `npm:praisonai` package versions >= 1.2.3 and <= 1.7.1, where the `SandboxExecutor`'s `allowedCommands` policy is bypassed by allowing arbitrary shell command chaining after an allowlisted command, leading to remote code execution with the PraisonAI process privileges.

npm:praisonai command-injection npm nodejs sandbox-bypass vulnerability rce server-side
1r 1t