CVE-2026-39377
Medium · 6.5CVSS
6.5
EPSS
0.4%
Published
Apr 21, 2026
CISA due date
—
The record
The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions 6.5 through 7.17.0 allow arbitrary file writes to locations outside the intended output directory when processing notebooks containing crafted cell attachment filenames. The `ExtractAttachmentsPreprocessor` passes attachment filenames directly to the filesystem without sanitization, enabling path traversal attacks. This vulnerability provides complete control over both the destination path and file extension. Version 7.17.1 contains a patch.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | python-nbconvert | 0 | 7.17.1-1.1 |
Related vulnerabilities
- CVE-2026-39378 The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other… Also affects python-nbconvert
- CVE-2025-53000 The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other… Also affects python-nbconvert
- CVE-2026-81163 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')… CWE-22
- CVE-2026-112049 Vita3K before build 4187 contains a path traversal (zip slip) vulnerability in… CWE-22
- CVE-2026-112005 WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote… CWE-22
- CVE-2026-61702 OpenPrinting CUPS is an open source printing system for Linux and other Unix-like… CWE-22
- CVE-2026-104871 The Angular SSR is a server-rise rendering tool for Angular applications. CWE-22
- CVE-2026-102991 Mako is a template library written in Python. CWE-22