Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package python-nbconvert for
openSUSE:Factory checked in at 2026-09-08 16:57:04
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/python-nbconvert (Old)
and /work/SRC/openSUSE:Factory/.python-nbconvert.new.1265 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "python-nbconvert"
Tue Sep 8 16:57:04 2026 rev:40 rq:1376195 version:7.17.1
Changes:
--------
--- /work/SRC/openSUSE:Factory/python-nbconvert/python-nbconvert.changes
2026-04-22 17:02:08.794320683 +0200
+++
/work/SRC/openSUSE:Factory/.python-nbconvert.new.1265/python-nbconvert.changes
2026-09-08 17:00:25.438756888 +0200
@@ -1,0 +2,8 @@
+Mon Sep 7 10:58:13 UTC 2026 - Daniel Garcia <[email protected]>
+
+- CVE-2026-6658: cross-site scripting (XSS) via unsanitized
+ `text/vnd.mermaid` output in HTML exports (bsc#1269365)
+ * Add patch 0001-fix-XSS-in-text-vnd.mermaid.patch
+ gh#jupyter/nbconvert#2294
+
+-------------------------------------------------------------------
New:
----
0001-fix-XSS-in-text-vnd.mermaid.patch
----------(New B)----------
New: `text/vnd.mermaid` output in HTML exports (bsc#1269365)
* Add patch 0001-fix-XSS-in-text-vnd.mermaid.patch
gh#jupyter/nbconvert#2294
----------(New E)----------
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ python-nbconvert.spec ++++++
--- /var/tmp/diff_new_pack.8BzHzS/_old 2026-09-08 17:00:26.470799760 +0200
+++ /var/tmp/diff_new_pack.8BzHzS/_new 2026-09-08 17:00:26.472799843 +0200
@@ -39,6 +39,8 @@
License: BSD-3-Clause AND MIT
URL: https://github.com/jupyter/nbconvert
Source0:
https://files.pythonhosted.org/packages/source/n/nbconvert/nbconvert-%{version}.tar.gz
+# PATCH-FIX-OPENSUSE 0001-fix-XSS-in-text-vnd.mermaid.patch bsc#1269365
gh#jupyter/nbconvert#2294
+Patch1: 0001-fix-XSS-in-text-vnd.mermaid.patch
BuildRequires: %{python_module base >= 3.8}
BuildRequires: %{python_module hatchling >= 0.25}
BuildRequires: %{python_module pip}
++++++ 0001-fix-XSS-in-text-vnd.mermaid.patch ++++++
>From 5a4c5faab6d6440c676fd906b115f06542031aef Mon Sep 17 00:00:00 2001
From: Daniel Garcia Moreno <[email protected]>
Date: Tue, 21 Jul 2026 09:06:22 +0200
Subject: [PATCH] fix: XSS in text/vnd.mermaid
This patch sanitizes the content of 'text/vnd.mermaid' on rendering to
avoid XSS
See https://www.cve.org/CVERecord?id=CVE-2026-6658
---
share/templates/lab/base.html.j2 | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/share/templates/lab/base.html.j2 b/share/templates/lab/base.html.j2
index cebe8410..052bb80c 100644
--- a/share/templates/lab/base.html.j2
+++ b/share/templates/lab/base.html.j2
@@ -176,7 +176,7 @@ unknown type {{ cell.type }}
{% block data_mermaid scoped -%}
<div class="jp-Mermaid">
<pre class="mermaid">
-{{ output.data['text/vnd.mermaid'].strip() }}
+{{ output.data['text/vnd.mermaid'].strip() | clean_html }}
</pre>
</div>
{%- endblock data_mermaid %}
--
2.55.0
