nbconvert vulnerabilities

The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. From 5.4.0 until 7.17.2, ExtractOutputPreprocessor in nbconvert/preprocessors/extractoutput.py joins the attacker-controlled cell output metadata filename to output_files_dir without limiting the result to the intended directory. When a victim converts a malicious notebook with the markdown, LaTeX, reStructuredText, or AsciiDoc exporter, path traversal in the output filename can write attacker-controlled output data to arbitrary locations accessible to the victim.

In nbconvert versions 6.5 through 7.17.0, when HTMLExporter.embed_images=True, the markdown renderer allows arbitrary file read via path traversal in image references. A malicious notebook can exfiltrate sensitive files from the conversion host by embedding them as base64 data URIs in the output HTML. Version 7.17.1 contains a fix.

nbconvert versions 6.5 through 7.17.0 allow arbitrary file writes outside the intended output directory when processing notebooks containing crafted cell attachment filenames. ExtractAttachmentsPreprocessor passes attachment filenames directly to the filesystem without sanitization, enabling path traversal attacks with complete control over the destination path and file extension. Version 7.17.1 contains a patch.