CVE-2026-114140
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. From 5.4.0 until 7.17.2, ExtractOutputPreprocessor in nbconvert/preprocessors/extractoutput.py joins the attacker-controlled cell output metadata filename to output_files_dir without limiting the result to the intended directory. When a victim converts a malicious notebook with the markdown, LaTeX, reStructuredText, or AsciiDoc exporter, path traversal in the output filename can write attacker-controlled output data to arbitrary locations accessible to the victim.
Risk Assessment
An attacker could trick a victim into converting a malicious notebook, allowing attacker-controlled data to be written to arbitrary locations on the victim's system, potentially leading to file overwrite or code execution.
Recommendation
Upgrade nbconvert to version 7.17.2, which fixes the issue.
Other vulnerabilities in nbconvert
See all- CVE-2026-39378Medium
In nbconvert versions 6.5 through 7.17.0, when HTMLExporter.embed_images=True, the markdown renderer allows arbitrary file read via path traversal in image references. A malicious notebook can exfiltrate sensitive files from the conversion host by embedding them as base64 data URIs in the output HTML. Version 7.17.1 contains a fix.
- CVE-2026-39377Medium
nbconvert versions 6.5 through 7.17.0 allow arbitrary file writes outside the intended output directory when processing notebooks containing crafted cell attachment filenames. ExtractAttachmentsPreprocessor passes attachment filenames directly to the filesystem without sanitization, enabling path traversal attacks with complete control over the destination path and file extension. Version 7.17.1 contains a patch.
Original NVD description (English source)
The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. From 5.4.0 until 7.17.2, ExtractOutputPreprocessor in nbconvert/preprocessors/extractoutput.py joins the attacker-controlled cell output metadata filename to output_files_dir without limiting the result to the intended directory. When a victim converts a malicious notebook with the markdown, LaTeX, reStructuredText, or AsciiDoc exporter, path traversal in the output filename can write attacker-controlled output data to arbitrary locations accessible to the victim. Running the notebook cell again replaces the malicious output metadata, but merely converting the supplied notebook does not. This issue is fixed in version 7.17.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS