nbconvert has an Arbitrary File Write via Path Traversal in Cell Attachment Filenames
概要
nbconvert has an Arbitrary File Write via Path Traversal in Cell Attachment Filenames
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions 6.5 through 7.17.0 allow arbitrary file writes to locations outside the intended output directory when processing notebooks containing crafted cell attachment filenames. The ExtractAttachmentsPreprocessor passes attachment filenames directly to the filesystem without sanitization, enabling path traversal attacks. This vulnerability provides complete control over both the destination path and file extension. Version 7.17.1 contains a patch.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2026-39377 nbconvert 修正版: 7.16.6-1+deb13u1
- Ubuntu UBUNTU-CVE-2026-39377 nbconvert
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web github.com