nbconvert has an Arbitrary File Read via Path Traversal in HTMLExporter Image Embedding
Summary
nbconvert has an Arbitrary File Read via Path Traversal in HTMLExporter Image Embedding
Original description
The description as published by the source.
The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. In versions 6.5 through 7.17.0, when HTMLExporter.embed_images=True, nbconvert's markdown renderer allows arbitrary file read via path traversal in image references. A malicious notebook can exfiltrate sensitive files from the conversion host by embedding them as base64 data URIs in the output HTML. nbconvert 7.17.1 contains a fix. As a workaround, do not enable HTMLExporter.embed_images; it is not enabled by default.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2026-39378 nbconvert
- Ubuntu UBUNTU-CVE-2026-39378 nbconvert
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web github.com