Introduction
A Markdown injection flaw in Azure Machine Learning Notebooks allows an unauthenticated attacker to spoof content and exfiltrate sensitive information from the Azure ML web interface. The attacker only has to get a user to open a crafted notebook. CVE-2026-33833 has a CVSS 3.1 base score of 8.2, and its Changed scope extends the impact beyond the vulnerable component itself. That makes it a meaningful confidentiality risk for any organization running data science workloads on Azure ML.
Microsoft disclosed and patched this vulnerability on May 12, 2026, in a Patch Tuesday cycle that addressed 120 vulnerabilities with no zero days. Exploitation is currently assessed as unlikely, but there are no workarounds or mitigations, so patching is the only remedy.
Technical Information
Root Cause: CWE-74 Injection in Markdown Rendering
The vulnerability is classified under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component. The Azure ML Notebook web interface did not properly sanitize user-supplied content in Markdown cells before rendering it in the browser. An attacker could embed malicious styling or markup in a Markdown cell. When another user opened or viewed that notebook, the browser would render the crafted content in the context of the Azure ML web application.
This is a classic output injection pattern. The notebook authoring component accepts arbitrary Markdown, but the rendering component (the Azure ML web UI) trusts that content without adequate neutralization. Because the rendering happens in the user's browser session within the Azure ML application context, the injected content can interact with or expose data visible in that session.
CVSS Vector Breakdown
The full CVSS 3.1 vector string is AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N/E:U/RL:O/RC:C.
| Metric | Value | Practical Implication |
|---|---|---|
| Attack Vector | Network | Exploitable remotely, with no physical or local access needed |
| Attack Complexity | Low | No specialized conditions or race conditions required |
| Privileges Required | None | The attacker does not need any authentication to craft the payload |
| User Interaction | Required | A victim must open or view the malicious notebook |
| Scope | Changed | Impact extends beyond the vulnerable Markdown renderer to the broader Azure ML web session |
| Confidentiality | High | Sensitive information displayed in the Azure ML interface can be exposed |
| Integrity | Low | Some modification of displayed information is possible |
| Availability | None | No denial of service impact |
The Changed scope metric means that the vulnerable component (the notebook Markdown renderer) and the impacted component (the Azure ML web interface session) are managed by different security authorities. The injection crosses a trust boundary, and that is what raises the base score.
Attack Flow
Exploitation follows four steps:
-
The attacker creates or imports an Azure ML notebook with malicious styling or markup in a Markdown cell. This step needs no authentication to the target environment. The attacker only has to produce a notebook file carrying the injected payload.
-
The attacker makes the notebook accessible to a target user, for example by sharing it in a workspace, uploading it to a shared storage location, or distributing it through any channel where Azure ML users might import notebooks.
-
A legitimate user opens or views the notebook in the Azure ML web interface, which renders the Markdown cell content without properly neutralizing the injected elements.
-
The injected content executes or renders in the context of the Azure ML web application, which lets the attacker view sensitive information displayed in the interface. The High confidentiality impact and Low integrity impact suggest the attacker can read significant data and possibly alter some of what the user sees.
Open Questions
The current advisories from Microsoft and the National Vulnerability Database do not give exact affected version ranges or any component builds other than the patched version (build 1.7.6 of @azure-notebooks). Organizations should verify their environments whatever version they assume they are running.
Patch Information
Microsoft released an official fix on May 12, 2026, in the May 2026 Patch Tuesday cycle. The patch targets the Azure Machine Learning Notebook component. It hardens output encoding and the neutralization of special elements in notebook Markdown rendering, so that injected content cannot be used to abuse downstream components.
The patched version is build 1.7.6 of the @azure-notebooks component, packaged in the aznb-bundle.js bundle. Microsoft distributes the security update through its CDN:
aznb-ame-prod.azureedge.net/component/1.7.6/aznb-bundle.js
Azure Machine Learning is a cloud-hosted service, and many updates are applied server side, but Microsoft has marked the Customer Action for this update as Required. Affected users should confirm that their environment is running the updated component instead of assuming the fix has been applied automatically.
Remediation summary:
| Remediation Type | Availability | Notes |
|---|---|---|
| Official Fix | Available (build 1.7.6) | Complete vendor solution, with a CVSS remediation level of Official Fix (RL:O) |
| Mitigations | None | Microsoft identifies no mitigating factors |
| Workarounds | None | Microsoft identifies no workarounds |
With no temporary controls to fall back on, the only decision left is when to patch. Microsoft rates the vulnerability as Exploitation Less Likely, so organizations can schedule the rollout in an orderly way. The high confidentiality impact still means it should not be pushed back indefinitely.
Release notes for the @azure-notebooks package are hosted on Azure DevOps Artifacts behind authentication, so the specific changelog entries are not publicly viewable.
Affected Systems and Versions
The affected product is Microsoft Azure Machine Learning, specifically its notebook rendering component. The patched build is 1.7.6 of the @azure-notebooks component, and any environment running an earlier version should be considered potentially vulnerable.
Neither Microsoft's advisory nor the NVD entry lists specific affected version ranges or identifies Azure ML configurations that are more or less susceptible. Any organization that uses Azure ML notebooks should verify it is running the updated component.
References
- Microsoft Security Update Guide: CVE-2026-33833
- NVD Entry: CVE-2026-33833
- Bleeping Computer: Microsoft Patch Tuesday May 2026 Report
- Zero Day Initiative: The May 2026 Security Update Review
- Bleeping Computer: Microsoft May 2026 Patch Tuesday fixes 120 flaws, no zero days
- Cyber Security News: 120 Vulnerabilities Fixed, Including 29 Critical RCE Flaws
- Microsoft Exploitability Index
