PT-2025-34179 · Microsoft+4 · Windows+4

Yohann Sillam · Published 2025-08-20 · Updated 2026-04-22 · CVE-2025-53000

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions nbconvert versions up to and including 7.16.6

Description The nbconvert tool, used for converting Jupyter notebooks to various formats, has an issue on Windows systems. Converting a notebook with SVG output to PDF can lead to unauthorized code execution. A malicious actor can create an inkscape.bat file containing a Windows batch script capable of arbitrary code execution. When a user runs jupyter nbconvert --to pdf on a notebook containing SVG output on a Windows platform from the directory containing the malicious file, the inkscape.bat file is unexpectedly executed. The issue involves the use of Jinja templates during the conversion process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2025-53000

GHSA-XM59-RQC7-HHVF

OPENSUSE-SU-2026:10603-1

Affected Products

Debian

Inkscape

Jupyter

Windows

Nconvert

References · 25

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53000.json · Exploit
• 🔥 https://imperva.com/blog/code-execution-in-jupyter-notebook-exports · Exploit
• https://osv.dev/vulnerability/GHSA-xm59-rqc7-hhvf · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-53000 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-53000 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-53000 · Security Note
• https://ubuntu.com/security/CVE-2025-53000 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-53000 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-53000 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10603-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-53000 · Vendor Advisory
• https://github.com/jupyter/nbconvert · Note
• https://github.com/jupyter/nbconvert/security/advisories/GHSA-xm59-rqc7-hhvf · Note
• https://github.com/jupyter/nbconvert/issues/2258 · Note
• https://github.com/jupyter/nbconvert/releases/tag/v7.17.0 · Note