Vulnerability-Lookup

OPENSUSE-SU-2026:10603-1

Vulnerability from csaf_opensuse - Published: 2026-04-22 00:00 - Updated: 2026-04-22 00:00

Summary

jupyter-nbconvert-7.17.1-1.1 on GA media

Severity

Moderate

Notes

Title of the patch: jupyter-nbconvert-7.17.1-1.1 on GA media

Description of the patch: These are all security issues fixed in the jupyter-nbconvert-7.17.1-1.1 package on the GA media of openSUSE Tumbleweed.

Patchnames: openSUSE-Tumbleweed-2026-10603

CVE-2025-53000

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Vendor Fix To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

CVE-2026-39377

Vendor Fix To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

CVE-2026-39378

Vendor Fix To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

References

URL

Category

	https://www.suse.com/support/security/rating/	external
	https://ftp.suse.com/pub/projects/security/csaf/o…	self
	https://www.suse.com/security/cve/CVE-2025-53000/	self
	https://www.suse.com/security/cve/CVE-2026-39377/	self
	https://www.suse.com/security/cve/CVE-2026-39378/	self
	https://www.suse.com/security/cve/CVE-2025-53000	external
	https://www.suse.com/security/cve/CVE-2026-39377	external
	https://bugzilla.suse.com/1262456	external
	https://www.suse.com/security/cve/CVE-2026-39378	external
	https://bugzilla.suse.com/1262457	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "jupyter-nbconvert-7.17.1-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the jupyter-nbconvert-7.17.1-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-10603",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_10603-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-53000 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-53000/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39377 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39377/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-39378 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-39378/"
      }
    ],
    "title": "jupyter-nbconvert-7.17.1-1.1 on GA media",
    "tracking": {
      "current_release_date": "2026-04-22T00:00:00Z",
      "generator": {
        "date": "2026-04-22T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:10603-1",
      "initial_release_date": "2026-04-22T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-04-22T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jupyter-nbconvert-7.17.1-1.1.aarch64",
                "product": {
                  "name": "jupyter-nbconvert-7.17.1-1.1.aarch64",
                  "product_id": "jupyter-nbconvert-7.17.1-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "jupyter-nbconvert-latex-7.17.1-1.1.aarch64",
                "product": {
                  "name": "jupyter-nbconvert-latex-7.17.1-1.1.aarch64",
                  "product_id": "jupyter-nbconvert-latex-7.17.1-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "python311-nbconvert-7.17.1-1.1.aarch64",
                "product": {
                  "name": "python311-nbconvert-7.17.1-1.1.aarch64",
                  "product_id": "python311-nbconvert-7.17.1-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "python313-nbconvert-7.17.1-1.1.aarch64",
                "product": {
                  "name": "python313-nbconvert-7.17.1-1.1.aarch64",
                  "product_id": "python313-nbconvert-7.17.1-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "python314-nbconvert-7.17.1-1.1.aarch64",
                "product": {
                  "name": "python314-nbconvert-7.17.1-1.1.aarch64",
                  "product_id": "python314-nbconvert-7.17.1-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jupyter-nbconvert-7.17.1-1.1.ppc64le",
                "product": {
                  "name": "jupyter-nbconvert-7.17.1-1.1.ppc64le",
                  "product_id": "jupyter-nbconvert-7.17.1-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "jupyter-nbconvert-latex-7.17.1-1.1.ppc64le",
                "product": {
                  "name": "jupyter-nbconvert-latex-7.17.1-1.1.ppc64le",
                  "product_id": "jupyter-nbconvert-latex-7.17.1-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "python311-nbconvert-7.17.1-1.1.ppc64le",
                "product": {
                  "name": "python311-nbconvert-7.17.1-1.1.ppc64le",
                  "product_id": "python311-nbconvert-7.17.1-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "python313-nbconvert-7.17.1-1.1.ppc64le",
                "product": {
                  "name": "python313-nbconvert-7.17.1-1.1.ppc64le",
                  "product_id": "python313-nbconvert-7.17.1-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "python314-nbconvert-7.17.1-1.1.ppc64le",
                "product": {
                  "name": "python314-nbconvert-7.17.1-1.1.ppc64le",
                  "product_id": "python314-nbconvert-7.17.1-1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jupyter-nbconvert-7.17.1-1.1.s390x",
                "product": {
                  "name": "jupyter-nbconvert-7.17.1-1.1.s390x",
                  "product_id": "jupyter-nbconvert-7.17.1-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "jupyter-nbconvert-latex-7.17.1-1.1.s390x",
                "product": {
                  "name": "jupyter-nbconvert-latex-7.17.1-1.1.s390x",
                  "product_id": "jupyter-nbconvert-latex-7.17.1-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "python311-nbconvert-7.17.1-1.1.s390x",
                "product": {
                  "name": "python311-nbconvert-7.17.1-1.1.s390x",
                  "product_id": "python311-nbconvert-7.17.1-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "python313-nbconvert-7.17.1-1.1.s390x",
                "product": {
                  "name": "python313-nbconvert-7.17.1-1.1.s390x",
                  "product_id": "python313-nbconvert-7.17.1-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "python314-nbconvert-7.17.1-1.1.s390x",
                "product": {
                  "name": "python314-nbconvert-7.17.1-1.1.s390x",
                  "product_id": "python314-nbconvert-7.17.1-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jupyter-nbconvert-7.17.1-1.1.x86_64",
                "product": {
                  "name": "jupyter-nbconvert-7.17.1-1.1.x86_64",
                  "product_id": "jupyter-nbconvert-7.17.1-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "jupyter-nbconvert-latex-7.17.1-1.1.x86_64",
                "product": {
                  "name": "jupyter-nbconvert-latex-7.17.1-1.1.x86_64",
                  "product_id": "jupyter-nbconvert-latex-7.17.1-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "python311-nbconvert-7.17.1-1.1.x86_64",
                "product": {
                  "name": "python311-nbconvert-7.17.1-1.1.x86_64",
                  "product_id": "python311-nbconvert-7.17.1-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "python313-nbconvert-7.17.1-1.1.x86_64",
                "product": {
                  "name": "python313-nbconvert-7.17.1-1.1.x86_64",
                  "product_id": "python313-nbconvert-7.17.1-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "python314-nbconvert-7.17.1-1.1.x86_64",
                "product": {
                  "name": "python314-nbconvert-7.17.1-1.1.x86_64",
                  "product_id": "python314-nbconvert-7.17.1-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jupyter-nbconvert-7.17.1-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:jupyter-nbconvert-7.17.1-1.1.aarch64"
        },
        "product_reference": "jupyter-nbconvert-7.17.1-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jupyter-nbconvert-7.17.1-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:jupyter-nbconvert-7.17.1-1.1.ppc64le"
        },
        "product_reference": "jupyter-nbconvert-7.17.1-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jupyter-nbconvert-7.17.1-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:jupyter-nbconvert-7.17.1-1.1.s390x"
        },
        "product_reference": "jupyter-nbconvert-7.17.1-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jupyter-nbconvert-7.17.1-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:jupyter-nbconvert-7.17.1-1.1.x86_64"
        },
        "product_reference": "jupyter-nbconvert-7.17.1-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jupyter-nbconvert-latex-7.17.1-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:jupyter-nbconvert-latex-7.17.1-1.1.aarch64"
        },
        "product_reference": "jupyter-nbconvert-latex-7.17.1-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jupyter-nbconvert-latex-7.17.1-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:jupyter-nbconvert-latex-7.17.1-1.1.ppc64le"
        },
        "product_reference": "jupyter-nbconvert-latex-7.17.1-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jupyter-nbconvert-latex-7.17.1-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:jupyter-nbconvert-latex-7.17.1-1.1.s390x"
        },
        "product_reference": "jupyter-nbconvert-latex-7.17.1-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jupyter-nbconvert-latex-7.17.1-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:jupyter-nbconvert-latex-7.17.1-1.1.x86_64"
        },
        "product_reference": "jupyter-nbconvert-latex-7.17.1-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-nbconvert-7.17.1-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python311-nbconvert-7.17.1-1.1.aarch64"
        },
        "product_reference": "python311-nbconvert-7.17.1-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-nbconvert-7.17.1-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python311-nbconvert-7.17.1-1.1.ppc64le"
        },
        "product_reference": "python311-nbconvert-7.17.1-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-nbconvert-7.17.1-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python311-nbconvert-7.17.1-1.1.s390x"
        },
        "product_reference": "python311-nbconvert-7.17.1-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-nbconvert-7.17.1-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python311-nbconvert-7.17.1-1.1.x86_64"
        },
        "product_reference": "python311-nbconvert-7.17.1-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-nbconvert-7.17.1-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-nbconvert-7.17.1-1.1.aarch64"
        },
        "product_reference": "python313-nbconvert-7.17.1-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-nbconvert-7.17.1-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-nbconvert-7.17.1-1.1.ppc64le"
        },
        "product_reference": "python313-nbconvert-7.17.1-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-nbconvert-7.17.1-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-nbconvert-7.17.1-1.1.s390x"
        },
        "product_reference": "python313-nbconvert-7.17.1-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-nbconvert-7.17.1-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-nbconvert-7.17.1-1.1.x86_64"
        },
        "product_reference": "python313-nbconvert-7.17.1-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-nbconvert-7.17.1-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-nbconvert-7.17.1-1.1.aarch64"
        },
        "product_reference": "python314-nbconvert-7.17.1-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-nbconvert-7.17.1-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-nbconvert-7.17.1-1.1.ppc64le"
        },
        "product_reference": "python314-nbconvert-7.17.1-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-nbconvert-7.17.1-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-nbconvert-7.17.1-1.1.s390x"
        },
        "product_reference": "python314-nbconvert-7.17.1-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-nbconvert-7.17.1-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-nbconvert-7.17.1-1.1.x86_64"
        },
        "product_reference": "python314-nbconvert-7.17.1-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-53000",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-53000"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions of nbconvert up to and including 7.16.6 on Windows have a vulnerability in which converting a notebook containing SVG output to a PDF results in unauthorized code execution. Specifically, a third party can create a `inkscape.bat` file that defines a Windows batch script, capable of arbitrary code execution. When a user runs `jupyter nbconvert --to pdf` on a notebook containing SVG output to a PDF on a Windows platform from this directory, the `inkscape.bat` file is run unexpectedly. This issue has been patched in version 7.17.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:jupyter-nbconvert-7.17.1-1.1.aarch64",
          "openSUSE Tumbleweed:jupyter-nbconvert-7.17.1-1.1.ppc64le",
          "openSUSE Tumbleweed:jupyter-nbconvert-7.17.1-1.1.s390x",
          "openSUSE Tumbleweed:jupyter-nbconvert-7.17.1-1.1.x86_64",
          "openSUSE Tumbleweed:jupyter-nbconvert-latex-7.17.1-1.1.aarch64",
          "openSUSE Tumbleweed:jupyter-nbconvert-latex-7.17.1-1.1.ppc64le",
          "openSUSE Tumbleweed:jupyter-nbconvert-latex-7.17.1-1.1.s390x",
          "openSUSE Tumbleweed:jupyter-nbconvert-latex-7.17.1-1.1.x86_64",
          "openSUSE Tumbleweed:python311-nbconvert-7.17.1-1.1.aarch64",
          "openSUSE Tumbleweed:python311-nbconvert-7.17.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python311-nbconvert-7.17.1-1.1.s390x",
          "openSUSE Tumbleweed:python311-nbconvert-7.17.1-1.1.x86_64",
          "openSUSE Tumbleweed:python313-nbconvert-7.17.1-1.1.aarch64",
          "openSUSE Tumbleweed:python313-nbconvert-7.17.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-nbconvert-7.17.1-1.1.s390x",
          "openSUSE Tumbleweed:python313-nbconvert-7.17.1-1.1.x86_64",
          "openSUSE Tumbleweed:python314-nbconvert-7.17.1-1.1.aarch64",
          "openSUSE Tumbleweed:python314-nbconvert-7.17.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-nbconvert-7.17.1-1.1.s390x",
          "openSUSE Tumbleweed:python314-nbconvert-7.17.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-53000",
          "url": "https://www.suse.com/security/cve/CVE-2025-53000"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:jupyter-nbconvert-7.17.1-1.1.aarch64",
            "openSUSE Tumbleweed:jupyter-nbconvert-7.17.1-1.1.ppc64le",
            "openSUSE Tumbleweed:jupyter-nbconvert-7.17.1-1.1.s390x",
            "openSUSE Tumbleweed:jupyter-nbconvert-7.17.1-1.1.x86_64",
            "openSUSE Tumbleweed:jupyter-nbconvert-latex-7.17.1-1.1.aarch64",
            "openSUSE Tumbleweed:jupyter-nbconvert-latex-7.17.1-1.1.ppc64le",
            "openSUSE Tumbleweed:jupyter-nbconvert-latex-7.17.1-1.1.s390x",
            "openSUSE Tumbleweed:jupyter-nbconvert-latex-7.17.1-1.1.x86_64",
            "openSUSE Tumbleweed:python311-nbconvert-7.17.1-1.1.aarch64",
            "openSUSE Tumbleweed:python311-nbconvert-7.17.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python311-nbconvert-7.17.1-1.1.s390x",
            "openSUSE Tumbleweed:python311-nbconvert-7.17.1-1.1.x86_64",
            "openSUSE Tumbleweed:python313-nbconvert-7.17.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-nbconvert-7.17.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-nbconvert-7.17.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-nbconvert-7.17.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-nbconvert-7.17.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-nbconvert-7.17.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-nbconvert-7.17.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-nbconvert-7.17.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:jupyter-nbconvert-7.17.1-1.1.aarch64",
            "openSUSE Tumbleweed:jupyter-nbconvert-7.17.1-1.1.ppc64le",
            "openSUSE Tumbleweed:jupyter-nbconvert-7.17.1-1.1.s390x",
            "openSUSE Tumbleweed:jupyter-nbconvert-7.17.1-1.1.x86_64",
            "openSUSE Tumbleweed:jupyter-nbconvert-latex-7.17.1-1.1.aarch64",
            "openSUSE Tumbleweed:jupyter-nbconvert-latex-7.17.1-1.1.ppc64le",
            "openSUSE Tumbleweed:jupyter-nbconvert-latex-7.17.1-1.1.s390x",
            "openSUSE Tumbleweed:jupyter-nbconvert-latex-7.17.1-1.1.x86_64",
            "openSUSE Tumbleweed:python311-nbconvert-7.17.1-1.1.aarch64",
            "openSUSE Tumbleweed:python311-nbconvert-7.17.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python311-nbconvert-7.17.1-1.1.s390x",
            "openSUSE Tumbleweed:python311-nbconvert-7.17.1-1.1.x86_64",
            "openSUSE Tumbleweed:python313-nbconvert-7.17.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-nbconvert-7.17.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-nbconvert-7.17.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-nbconvert-7.17.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-nbconvert-7.17.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-nbconvert-7.17.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-nbconvert-7.17.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-nbconvert-7.17.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-22T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-53000"
    },
    {
      "cve": "CVE-2026-39377",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39377"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions 6.5 through 7.17.0 allow arbitrary file writes to locations outside the intended output directory when processing notebooks containing crafted cell attachment filenames. The `ExtractAttachmentsPreprocessor` passes attachment filenames directly to the filesystem without sanitization, enabling path traversal attacks. This vulnerability provides complete control over both the destination path and file extension. Version 7.17.1 contains a patch.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:jupyter-nbconvert-7.17.1-1.1.aarch64",
          "openSUSE Tumbleweed:jupyter-nbconvert-7.17.1-1.1.ppc64le",
          "openSUSE Tumbleweed:jupyter-nbconvert-7.17.1-1.1.s390x",
          "openSUSE Tumbleweed:jupyter-nbconvert-7.17.1-1.1.x86_64",
          "openSUSE Tumbleweed:jupyter-nbconvert-latex-7.17.1-1.1.aarch64",
          "openSUSE Tumbleweed:jupyter-nbconvert-latex-7.17.1-1.1.ppc64le",
          "openSUSE Tumbleweed:jupyter-nbconvert-latex-7.17.1-1.1.s390x",
          "openSUSE Tumbleweed:jupyter-nbconvert-latex-7.17.1-1.1.x86_64",
          "openSUSE Tumbleweed:python311-nbconvert-7.17.1-1.1.aarch64",
          "openSUSE Tumbleweed:python311-nbconvert-7.17.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python311-nbconvert-7.17.1-1.1.s390x",
          "openSUSE Tumbleweed:python311-nbconvert-7.17.1-1.1.x86_64",
          "openSUSE Tumbleweed:python313-nbconvert-7.17.1-1.1.aarch64",
          "openSUSE Tumbleweed:python313-nbconvert-7.17.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-nbconvert-7.17.1-1.1.s390x",
          "openSUSE Tumbleweed:python313-nbconvert-7.17.1-1.1.x86_64",
          "openSUSE Tumbleweed:python314-nbconvert-7.17.1-1.1.aarch64",
          "openSUSE Tumbleweed:python314-nbconvert-7.17.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-nbconvert-7.17.1-1.1.s390x",
          "openSUSE Tumbleweed:python314-nbconvert-7.17.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39377",
          "url": "https://www.suse.com/security/cve/CVE-2026-39377"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1262456 for CVE-2026-39377",
          "url": "https://bugzilla.suse.com/1262456"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:jupyter-nbconvert-7.17.1-1.1.aarch64",
            "openSUSE Tumbleweed:jupyter-nbconvert-7.17.1-1.1.ppc64le",
            "openSUSE Tumbleweed:jupyter-nbconvert-7.17.1-1.1.s390x",
            "openSUSE Tumbleweed:jupyter-nbconvert-7.17.1-1.1.x86_64",
            "openSUSE Tumbleweed:jupyter-nbconvert-latex-7.17.1-1.1.aarch64",
            "openSUSE Tumbleweed:jupyter-nbconvert-latex-7.17.1-1.1.ppc64le",
            "openSUSE Tumbleweed:jupyter-nbconvert-latex-7.17.1-1.1.s390x",
            "openSUSE Tumbleweed:jupyter-nbconvert-latex-7.17.1-1.1.x86_64",
            "openSUSE Tumbleweed:python311-nbconvert-7.17.1-1.1.aarch64",
            "openSUSE Tumbleweed:python311-nbconvert-7.17.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python311-nbconvert-7.17.1-1.1.s390x",
            "openSUSE Tumbleweed:python311-nbconvert-7.17.1-1.1.x86_64",
            "openSUSE Tumbleweed:python313-nbconvert-7.17.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-nbconvert-7.17.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-nbconvert-7.17.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-nbconvert-7.17.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-nbconvert-7.17.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-nbconvert-7.17.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-nbconvert-7.17.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-nbconvert-7.17.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-22T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-39377"
    },
    {
      "cve": "CVE-2026-39378",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-39378"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. In versions 6.5 through 7.17.0, when `HTMLExporter.embed_images=True`, nbconvert\u0027s markdown renderer allows arbitrary file read via path traversal in image references. A malicious notebook can exfiltrate sensitive files from the conversion host by embedding them as base64 data URIs in the output HTML. nbconvert 7.17.1 contains a fix. As a workaround, do not enable `HTMLExporter.embed_images`; it is not enabled by default.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:jupyter-nbconvert-7.17.1-1.1.aarch64",
          "openSUSE Tumbleweed:jupyter-nbconvert-7.17.1-1.1.ppc64le",
          "openSUSE Tumbleweed:jupyter-nbconvert-7.17.1-1.1.s390x",
          "openSUSE Tumbleweed:jupyter-nbconvert-7.17.1-1.1.x86_64",
          "openSUSE Tumbleweed:jupyter-nbconvert-latex-7.17.1-1.1.aarch64",
          "openSUSE Tumbleweed:jupyter-nbconvert-latex-7.17.1-1.1.ppc64le",
          "openSUSE Tumbleweed:jupyter-nbconvert-latex-7.17.1-1.1.s390x",
          "openSUSE Tumbleweed:jupyter-nbconvert-latex-7.17.1-1.1.x86_64",
          "openSUSE Tumbleweed:python311-nbconvert-7.17.1-1.1.aarch64",
          "openSUSE Tumbleweed:python311-nbconvert-7.17.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python311-nbconvert-7.17.1-1.1.s390x",
          "openSUSE Tumbleweed:python311-nbconvert-7.17.1-1.1.x86_64",
          "openSUSE Tumbleweed:python313-nbconvert-7.17.1-1.1.aarch64",
          "openSUSE Tumbleweed:python313-nbconvert-7.17.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-nbconvert-7.17.1-1.1.s390x",
          "openSUSE Tumbleweed:python313-nbconvert-7.17.1-1.1.x86_64",
          "openSUSE Tumbleweed:python314-nbconvert-7.17.1-1.1.aarch64",
          "openSUSE Tumbleweed:python314-nbconvert-7.17.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-nbconvert-7.17.1-1.1.s390x",
          "openSUSE Tumbleweed:python314-nbconvert-7.17.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-39378",
          "url": "https://www.suse.com/security/cve/CVE-2026-39378"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1262457 for CVE-2026-39378",
          "url": "https://bugzilla.suse.com/1262457"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:jupyter-nbconvert-7.17.1-1.1.aarch64",
            "openSUSE Tumbleweed:jupyter-nbconvert-7.17.1-1.1.ppc64le",
            "openSUSE Tumbleweed:jupyter-nbconvert-7.17.1-1.1.s390x",
            "openSUSE Tumbleweed:jupyter-nbconvert-7.17.1-1.1.x86_64",
            "openSUSE Tumbleweed:jupyter-nbconvert-latex-7.17.1-1.1.aarch64",
            "openSUSE Tumbleweed:jupyter-nbconvert-latex-7.17.1-1.1.ppc64le",
            "openSUSE Tumbleweed:jupyter-nbconvert-latex-7.17.1-1.1.s390x",
            "openSUSE Tumbleweed:jupyter-nbconvert-latex-7.17.1-1.1.x86_64",
            "openSUSE Tumbleweed:python311-nbconvert-7.17.1-1.1.aarch64",
            "openSUSE Tumbleweed:python311-nbconvert-7.17.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python311-nbconvert-7.17.1-1.1.s390x",
            "openSUSE Tumbleweed:python311-nbconvert-7.17.1-1.1.x86_64",
            "openSUSE Tumbleweed:python313-nbconvert-7.17.1-1.1.aarch64",
            "openSUSE Tumbleweed:python313-nbconvert-7.17.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-nbconvert-7.17.1-1.1.s390x",
            "openSUSE Tumbleweed:python313-nbconvert-7.17.1-1.1.x86_64",
            "openSUSE Tumbleweed:python314-nbconvert-7.17.1-1.1.aarch64",
            "openSUSE Tumbleweed:python314-nbconvert-7.17.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-nbconvert-7.17.1-1.1.s390x",
            "openSUSE Tumbleweed:python314-nbconvert-7.17.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-22T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-39378"
    }
  ]
}

CVE-2026-39377 (GCVE-0-2026-39377)

Vulnerability from cvelistv5 – Published: 2026-04-21 00:14 – Updated: 2026-04-21 19:49

Title

nbconvert has an Arbitrary File Write via Path Traversal in Cell Attachment Filenames

Summary

The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions 6.5 through 7.17.0 allow arbitrary file writes to locations outside the intended output directory when processing notebooks containing crafted cell attachment filenames. The `ExtractAttachmentsPreprocessor` passes attachment filenames directly to the filesystem without sanitization, enabling path traversal attacks. This vulnerability provides complete control over both the destination path and file extension. Version 7.17.1 contains a patch.

Severity ?

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-73 - External Control of File Name or Path

Assigner

GitHub_M

References

URL

Tags

	https://github.com/jupyter/nbconvert/security/adv…	x_refsource_CONFIRM
	https://github.com/jupyter/nbconvert/releases/tag…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	jupyter	nbconvert	Affected: >= 6.5, < 7.17.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-39377",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-21T16:01:22.179013Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-21T19:49:24.475Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nbconvert",
          "vendor": "jupyter",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 6.5, \u003c 7.17.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions 6.5 through 7.17.0 allow arbitrary file writes to locations outside the intended output directory when processing notebooks containing crafted cell attachment filenames. The `ExtractAttachmentsPreprocessor` passes attachment filenames directly to the filesystem without sanitization, enabling path traversal attacks. This vulnerability provides complete control over both the destination path and file extension. Version 7.17.1 contains a patch."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-73",
              "description": "CWE-73: External Control of File Name or Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-21T00:14:59.937Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/jupyter/nbconvert/security/advisories/GHSA-4c99-qj7h-p3vg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/jupyter/nbconvert/security/advisories/GHSA-4c99-qj7h-p3vg"
        },
        {
          "name": "https://github.com/jupyter/nbconvert/releases/tag/v7.17.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jupyter/nbconvert/releases/tag/v7.17.1"
        }
      ],
      "source": {
        "advisory": "GHSA-4c99-qj7h-p3vg",
        "discovery": "UNKNOWN"
      },
      "title": "nbconvert has an Arbitrary File Write via Path Traversal in Cell Attachment Filenames"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-39377",
    "datePublished": "2026-04-21T00:14:59.937Z",
    "dateReserved": "2026-04-06T21:29:17.350Z",
    "dateUpdated": "2026-04-21T19:49:24.475Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-53000 (GCVE-0-2025-53000)

Vulnerability from cvelistv5 – Published: 2025-12-17 20:27 – Updated: 2026-02-18 18:36

Title

nbconvert has an uncontrolled search path that leads to unauthorized code execution on Windows

Summary

The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions of nbconvert up to and including 7.16.6 on Windows have a vulnerability in which converting a notebook containing SVG output to a PDF results in unauthorized code execution. Specifically, a third party can create a `inkscape.bat` file that defines a Windows batch script, capable of arbitrary code execution. When a user runs `jupyter nbconvert --to pdf` on a notebook containing SVG output to a PDF on a Windows platform from this directory, the `inkscape.bat` file is run unexpectedly. This issue has been patched in version 7.17.0.

Severity ?

8.5 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CWE

CWE-427 - Uncontrolled Search Path Element

Assigner

GitHub_M

References

URL

Tags

	https://github.com/jupyter/nbconvert/security/adv…	x_refsource_CONFIRM
	https://github.com/jupyter/nbconvert/issues/2258	x_refsource_MISC
	https://github.com/jupyter/nbconvert/commit/c9ac1…	x_refsource_MISC
	https://github.com/jupyter/nbconvert/blob/4f61702…	x_refsource_MISC
	https://github.com/jupyter/nbconvert/releases/tag…	x_refsource_MISC
	https://www.imperva.com/blog/code-execution-in-ju…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	jupyter	nbconvert	Affected: < 7.17.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-53000",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-17T20:43:43.579788Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-18T15:09:46.627Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://www.imperva.com/blog/code-execution-in-jupyter-notebook-exports"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nbconvert",
          "vendor": "jupyter",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 7.17.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions of nbconvert up to and including 7.16.6 on Windows have a vulnerability in which converting a notebook containing SVG output to a PDF results in unauthorized code execution. Specifically, a third party can create a `inkscape.bat` file that defines a Windows batch script, capable of arbitrary code execution. When a user runs `jupyter nbconvert --to pdf` on a notebook containing SVG output to a PDF on a Windows platform from this directory, the `inkscape.bat` file is run unexpectedly. This issue has been patched in version 7.17.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-427",
              "description": "CWE-427: Uncontrolled Search Path Element",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-18T18:36:34.309Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/jupyter/nbconvert/security/advisories/GHSA-xm59-rqc7-hhvf",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/jupyter/nbconvert/security/advisories/GHSA-xm59-rqc7-hhvf"
        },
        {
          "name": "https://github.com/jupyter/nbconvert/issues/2258",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jupyter/nbconvert/issues/2258"
        },
        {
          "name": "https://github.com/jupyter/nbconvert/commit/c9ac1d1040459ed1ff9eb34e9918ce5a87cf9d71",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jupyter/nbconvert/commit/c9ac1d1040459ed1ff9eb34e9918ce5a87cf9d71"
        },
        {
          "name": "https://github.com/jupyter/nbconvert/blob/4f61702f5c7524d8a3c4ac0d5fc33a6ac2fa36a7/nbconvert/preprocessors/svg2pdf.py#L104",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jupyter/nbconvert/blob/4f61702f5c7524d8a3c4ac0d5fc33a6ac2fa36a7/nbconvert/preprocessors/svg2pdf.py#L104"
        },
        {
          "name": "https://github.com/jupyter/nbconvert/releases/tag/v7.17.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jupyter/nbconvert/releases/tag/v7.17.0"
        },
        {
          "name": "https://www.imperva.com/blog/code-execution-in-jupyter-notebook-exports",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.imperva.com/blog/code-execution-in-jupyter-notebook-exports"
        }
      ],
      "source": {
        "advisory": "GHSA-xm59-rqc7-hhvf",
        "discovery": "UNKNOWN"
      },
      "title": "nbconvert has an uncontrolled search path that leads to unauthorized code execution on Windows"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-53000",
    "datePublished": "2025-12-17T20:27:59.578Z",
    "dateReserved": "2025-06-24T03:50:36.795Z",
    "dateUpdated": "2026-02-18T18:36:34.309Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-39378 (GCVE-0-2026-39378)

Vulnerability from cvelistv5 – Published: 2026-04-21 00:17 – Updated: 2026-04-21 13:43

Title

nbconvert has an Arbitrary File Read via Path Traversal in HTMLExporter Image Embedding

Summary

The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. In versions 6.5 through 7.17.0, when `HTMLExporter.embed_images=True`, nbconvert's markdown renderer allows arbitrary file read via path traversal in image references. A malicious notebook can exfiltrate sensitive files from the conversion host by embedding them as base64 data URIs in the output HTML. nbconvert 7.17.1 contains a fix. As a workaround, do not enable `HTMLExporter.embed_images`; it is not enabled by default.

Severity ?

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-73 - External Control of File Name or Path

Assigner

GitHub_M

References

URL

Tags

	https://github.com/jupyter/nbconvert/security/adv…	x_refsource_CONFIRM
	https://github.com/jupyter/nbconvert/releases/tag…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	jupyter	nbconvert	Affected: >= 6.5, < 7.17.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-39378",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-21T13:43:09.070985Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-21T13:43:29.081Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nbconvert",
          "vendor": "jupyter",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 6.5, \u003c 7.17.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. In versions 6.5 through 7.17.0, when `HTMLExporter.embed_images=True`, nbconvert\u0027s markdown renderer allows arbitrary file read via path traversal in image references. A malicious notebook can exfiltrate sensitive files from the conversion host by embedding them as base64 data URIs in the output HTML. nbconvert 7.17.1 contains a fix. As a workaround, do not enable `HTMLExporter.embed_images`; it is not enabled by default."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-73",
              "description": "CWE-73: External Control of File Name or Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-21T00:17:00.684Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/jupyter/nbconvert/security/advisories/GHSA-7jqv-fw35-gmx9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/jupyter/nbconvert/security/advisories/GHSA-7jqv-fw35-gmx9"
        },
        {
          "name": "https://github.com/jupyter/nbconvert/releases/tag/v7.17.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jupyter/nbconvert/releases/tag/v7.17.1"
        }
      ],
      "source": {
        "advisory": "GHSA-7jqv-fw35-gmx9",
        "discovery": "UNKNOWN"
      },
      "title": "nbconvert has an Arbitrary File Read via Path Traversal in HTMLExporter Image Embedding"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-39378",
    "datePublished": "2026-04-21T00:17:00.684Z",
    "dateReserved": "2026-04-06T21:29:17.350Z",
    "dateUpdated": "2026-04-21T13:43:29.081Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

OPENSUSE-SU-2026:10603-1

CVE-2026-39377 (GCVE-0-2026-39377)

CVE-2025-53000 (GCVE-0-2025-53000)

CVE-2026-39378 (GCVE-0-2026-39378)

Tags

Sightings

Nomenclature