{"id":"CVE-2026-123288","kind":"vulnerability","aliases":["CVE-2026-123288"],"related":[],"title":"JetBrains Datalore: stored XSS in notebook charts via Vega editor link","description":"In JetBrains Datalore before 2026.4 stored XSS in notebook charts was possible via Vega editor link","summary":"JetBrains Datalore before 2026.4 let stored cross-site scripting occur through notebook charts opened from a Vega editor link. An attacker who can place such content in a notebook could run script in another user's browser session.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["datalore","jetbrains","notebooks","other"],"not_affected_if":["datalore-2026.4-or-later"],"how_to_check":"- Check the installed Datalore version against the fixed version in the sources (`2026.4`)","fix":"- Datalore: move to `2026.4` or later (per the affected range 'before 2026.4')","status":"open","published_at":"2026-11-06T11:17:07+00:00","first_seen_at":"2026-11-06T11:41:24+00:00","triaged_at":"2026-11-06T11:42:32+00:00","updated_at":"2026-11-06T11:42:32+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-06T11:42:32Z","model":"claude-haiku-5-5","output":{"fix":"- Datalore: move to `2026.4` or later (per the affected range 'before 2026.4')","reach":"unknown","title":"JetBrains Datalore: stored XSS in notebook charts via Vega editor link","impact":"medium","summary":"JetBrains Datalore before 2026.4 let stored cross-site scripting occur through notebook charts opened from a Vega editor link. An attacker who can place such content in a notebook could run script in another user's browser session.","audience":"businesses","category":"other","nicknames":[],"who_cares":["jetbrains","datalore","notebooks"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"script runs in other users' browser sessions","analyst_note":"Confirm trigger conditions, required role and whether shared notebooks are needed via the JetBrains advisory for CVE-2026-123288.","how_to_check":"- Check the installed Datalore version against the fixed version in the sources (`2026.4`)\n- unknown for other checks: the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["datalore-2026.4-or-later"],"who_is_affected":"Teams running JetBrains Datalore for notebooks with charts, especially where multiple users share notebooks. The sources do not describe the exact trigger or the required role, so the unknown parts should be confirmed against the vendor advisory.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000677,"input_tokens":4164,"output_tokens":522,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123288':14A,17A '-2026':13A,16A '2026.4':24B,64C 'anoth':55B 'attack':42B 'browser':58B 'chart':7A,34B,69C 'content':47B 'could':51B 'cross':28B 'cross-sit':27B 'cve':12A,15A 'datalor':2A,18B,22B,62C 'editor':10A,39B,74C 'jetbrain':1A,19B,21B,61C 'let':25B 'link':11A,40B,75C 'notebook':6A,20B,33B,50B,68C 'occur':31B 'open':35B 'place':45B 'possibl':71C 'run':52B 'script':30B,53B 'session':59B 'site':29B 'store':3A,26B,65C 'user':56B 'vega':9A,38B,73C 'via':8A,72C 'xss':4A,66C","nicknames":[],"mitigations":[],"who_affected":"Teams running JetBrains Datalore for notebooks with charts, especially where multiple users share notebooks. The sources do not describe the exact trigger or the required role, so the unknown parts should be confirmed against the vendor advisory.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["datalore","jetbrains","medium","notebooks","other"],"campaign_type":null,"search_a":"'-123288':14A,17A '-2026':13A,16A 'chart':7A 'cve':12A,15A 'datalor':2A 'editor':10A 'jetbrain':1A 'link':11A 'notebook':6A 'store':3A 'vega':9A 'via':8A 'xss':4A","search_b":"'2026.4':24B 'anoth':55B 'attack':42B 'browser':58B 'chart':34B 'content':47B 'could':51B 'cross':28B 'cross-sit':27B 'datalor':18B,22B 'editor':39B 'jetbrain':19B,21B 'let':25B 'link':40B 'notebook':20B,33B,50B 'occur':31B 'open':35B 'place':45B 'run':52B 'script':30B,53B 'session':59B 'site':29B 'store':26B 'user':56B 'vega':38B","search_c":"'2026.4':64C 'chart':69C 'datalor':62C 'editor':74C 'jetbrain':61C 'link':75C 'notebook':68C 'possibl':71C 'store':65C 'vega':73C 'via':72C 'xss':66C","first_public_at":"2026-11-06T11:17:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123288","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123288","severity":null,"published_at":"2026-11-06T11:17:07+00:00","modified_at":"2026-11-06T11:17:07+00:00","first_seen_at":"2026-11-06T11:41:24+00:00","fetched_at":"2026-11-06T11:41:24+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}