Vulnerability Description
The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions 6.5 through 7.17.0 allow arbitrary file writes to locations outside the intended output directory when processing notebooks containing crafted cell attachment filenames. The `ExtractAttachmentsPreprocessor` passes attachment filenames directly to the filesystem without sanitization, enabling path traversal attacks. This vulnerability provides complete control over both the destination path and file extension. Version 7.17.1 contains a patch.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Jupyter | Nbconvert | >= 6.5.0, < 7.17.1 |
Related Weaknesses (CWE)
References
- https://github.com/jupyter/nbconvert/releases/tag/v7.17.1Product
- https://github.com/jupyter/nbconvert/security/advisories/GHSA-4c99-qj7h-p3vgMitigationVendor Advisory
FAQ
What is CVE-2026-39377?
CVE-2026-39377 is a vulnerability with a CVSS score of 6.5 (MEDIUM). The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions 6.5 through 7.17.0 allow arbitrary file writes to locations outside the intende...
How severe is CVE-2026-39377?
CVE-2026-39377 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-39377?
Check the references section above for vendor advisories and patch information. Affected products include: Jupyter Nbconvert.