CVE-2026-39378
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
In nbconvert versions 6.5 through 7.17.0, when HTMLExporter.embed_images=True, the markdown renderer allows arbitrary file read via path traversal in image references. A malicious notebook can exfiltrate sensitive files from the conversion host by embedding them as base64 data URIs in the output HTML. Version 7.17.1 contains a fix.
Risk Assessment
A person converting a malicious notebook may expose confidential files from the system running nbconvert. This can lead to data leakage and confidentiality breach.
Recommendation
Upgrade nbconvert to version 7.17.1 or later. As a workaround, do not enable HTMLExporter.embed_images (disabled by default).
Other vulnerabilities in nbconvert
See all- CVE-2026-114140High
The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. From 5.4.0 until 7.17.2, ExtractOutputPreprocessor in nbconvert/preprocessors/extractoutput.py joins the attacker-controlled cell output metadata filename to output_files_dir without limiting the result to the intended directory. When a victim converts a malicious notebook with the markdown, LaTeX, reStructuredText, or AsciiDoc exporter, path traversal in the output filename can write attacker-controlled output data to arbitrary locations accessible to the victim.
- CVE-2026-39377Medium
nbconvert versions 6.5 through 7.17.0 allow arbitrary file writes outside the intended output directory when processing notebooks containing crafted cell attachment filenames. ExtractAttachmentsPreprocessor passes attachment filenames directly to the filesystem without sanitization, enabling path traversal attacks with complete control over the destination path and file extension. Version 7.17.1 contains a patch.
Original NVD description (English source)
The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. In versions 6.5 through 7.17.0, when `HTMLExporter.embed_images=True`, nbconvert's markdown renderer allows arbitrary file read via path traversal in image references. A malicious notebook can exfiltrate sensitive files from the conversion host by embedding them as base64 data URIs in the output HTML. nbconvert 7.17.1 contains a fix. As a workaround, do not enable `HTMLExporter.embed_images`; it is not enabled by default.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS