CVE-2026-39377
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
nbconvert versions 6.5 through 7.17.0 allow arbitrary file writes outside the intended output directory when processing notebooks containing crafted cell attachment filenames. ExtractAttachmentsPreprocessor passes attachment filenames directly to the filesystem without sanitization, enabling path traversal attacks with complete control over the destination path and file extension. Version 7.17.1 contains a patch.
Risk Assessment
An attacker could write arbitrary files to any location writable by the nbconvert process, potentially overwriting configuration files or achieving code execution. The risk applies to environments processing untrusted Jupyter notebooks.
Recommendation
Upgrade nbconvert to version 7.17.1 or later. Process untrusted notebooks in an isolated environment with limited write permissions.
Other vulnerabilities in nbconvert
See all- CVE-2026-114140High
The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. From 5.4.0 until 7.17.2, ExtractOutputPreprocessor in nbconvert/preprocessors/extractoutput.py joins the attacker-controlled cell output metadata filename to output_files_dir without limiting the result to the intended directory. When a victim converts a malicious notebook with the markdown, LaTeX, reStructuredText, or AsciiDoc exporter, path traversal in the output filename can write attacker-controlled output data to arbitrary locations accessible to the victim.
- CVE-2026-39378Medium
In nbconvert versions 6.5 through 7.17.0, when HTMLExporter.embed_images=True, the markdown renderer allows arbitrary file read via path traversal in image references. A malicious notebook can exfiltrate sensitive files from the conversion host by embedding them as base64 data URIs in the output HTML. Version 7.17.1 contains a fix.
Original NVD description (English source)
The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions 6.5 through 7.17.0 allow arbitrary file writes to locations outside the intended output directory when processing notebooks containing crafted cell attachment filenames. The `ExtractAttachmentsPreprocessor` passes attachment filenames directly to the filesystem without sanitization, enabling path traversal attacks. This vulnerability provides complete control over both the destination path and file extension. Version 7.17.1 contains a patch.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS