CVE-2026-123288: JetBrains Datalore: stored XSS in notebook charts

MEDIUM

Published November 6, 2026

CISO Take

JetBrains Datalore, a hosted data-science notebook platform, contains a stored cross-site scripting flaw in notebook charts that can be triggered through the Vega editor link. A low-privileged user can plant a payload that runs in the browser of any colleague who opens the chart. Severity is medium (CVSS 5.4); the changed scope means the script runs in the victim's session context. No public exploit, Nuclei template or CISA KEV listing exists, and no EPSS score is available yet, so near-term mass exploitation looks unlikely. The most plausible abuse is targeted: hijacking a data scientist's session to reach shared notebooks, datasets and connected data-source credentials. Upgrade Datalore to 2026.4 or later, and until then limit notebook edit rights to trusted users and enforce a strict Content Security Policy.

Sources:NVDjetbrains.comATLAS

What is the risk?

Medium overall. The attack is network-reachable, low complexity, needs a low-privileged account, and requires a victim to open the chart (CVSS 5.4, scope changed). Exploitation likelihood is low to moderate: there is no known public exploit, no KEV listing, and no EPSS data. Exposure is highest in multi-user Datalore deployments where notebooks are shared across teams, because a stored payload can reach many viewers. Confidence in this assessment is MEDIUM, as the advisory gives few technical details.

How does the attack unfold?

Initial Access

An attacker with a low-privilege account crafts a notebook chart with a malicious Vega editor link.

AML.T0049

User Execution

A victim opens the shared chart or follows the Vega editor link, triggering the stored script.

AML.T0011.003

Exploitation

The injected JavaScript runs in the victim's authenticated Datalore session.

Impact

The attacker steals session tokens and reads notebooks, datasets and data-source credentials.

Initial Access

An attacker with a low-privilege account crafts a notebook chart with a malicious Vega editor link.

AML.T0049

User Execution

A victim opens the shared chart or follows the Vega editor link, triggering the stored script.

AML.T0011.003

Exploitation

The injected JavaScript runs in the victim's authenticated Datalore session.

Impact

The attacker steals session tokens and reads notebooks, datasets and data-source credentials.

How severe is it?

CVSS 3.1

5.4 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UIRequired

SChanged

CLow

ILow

ANone

What should I do?

1 step

1) Upgrade JetBrains Datalore to version 2026.4 or later, as listed on the JetBrains 'issues fixed' page. 2) Until patched, restrict notebook creation and edit permissions to trusted users and review recently shared notebooks for unexpected chart or Vega editor links. 3) Apply a restrictive Content Security Policy and set session cookies HttpOnly, Secure and SameSite. 4) Rotate credentials for data sources connected to Datalore if suspicious chart content is found. 5) Monitor web logs for unusual outbound requests from notebook pages and for edits adding external links to charts.

How is it classified?

Data LeakageSocial EngineeringFrameworkAML.T0011.003- Malicious Link AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks and treatment of known vulnerabilities

Frequently Asked Questions

What is CVE-2026-123288?

Is CVE-2026-123288 actively exploited?

No confirmed active exploitation of CVE-2026-123288 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-123288?

1) Upgrade JetBrains Datalore to version 2026.4 or later, as listed on the JetBrains 'issues fixed' page. 2) Until patched, restrict notebook creation and edit permissions to trusted users and review recently shared notebooks for unexpected chart or Vega editor links. 3) Apply a restrictive Content Security Policy and set session cookies HttpOnly, Secure and SameSite. 4) Rotate credentials for data sources connected to Datalore if suspicious chart content is found. 5) Monitor web logs for unusual outbound requests from notebook pages and for edits adding external links to charts.

What systems are affected by CVE-2026-123288?

This vulnerability affects the following AI/ML architecture patterns: notebook environments, training pipelines, data science platforms.

What is the CVSS score for CVE-2026-123288?

CVE-2026-123288 has a CVSS v3.1 base score of 5.4 (MEDIUM).

What is the AI security impact?

Affected AI Architectures

notebook environmentstraining pipelinesdata science platforms

MITRE ATLAS Techniques

AML.T0011.003Malicious Link

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

In JetBrains Datalore before 2026.4 stored XSS in notebook charts was possible via Vega editor link

Exploitation Scenario

An attacker with a low-privilege Datalore account creates a notebook containing a chart whose Vega editor link carries a malicious script payload. They share the notebook with a senior data scientist or ML engineer. When the victim opens the chart or follows the Vega editor link, the script runs in their authenticated session. It then exfiltrates session tokens and reads accessible notebooks, datasets and stored data-source connection details, giving the attacker access to proprietary training data and experiment results.

Weaknesses (CWE)

CWE-79Improper Neutralization of Input During Web Page GenerationPrimary CWE-79Improper Neutralization of Input During Web Page Generation

CWE-79 — Improper Neutralization of Input During Web Page Generation: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.
[Implementation, Architecture and Design] Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies. For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters. Parts of the same output document may require different encodings, which will vary depending on whether the output is in the: etc. Note that HTML Entity Encoding is only appropriate for the HTML body. Consult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed. HTML body Element attributes (such as src="XYZ") URIs JavaScript sections Casca

Source: MITRE CWE corpus.