PT-2026-33878 · Nbconvert · Nconvert

Published 2026-04-21 · Updated 2026-05-11 · CVE-2026-39377

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions nbconvert versions 6.5 through 7.17.0

Description The nbconvert tool converts Jupyter notebooks to various formats using Jinja templates. A path traversal issue exists where the ExtractAttachmentsPreprocessor function passes attachment filenames directly to the filesystem without sanitization. This allows arbitrary file writes to locations outside the intended output directory, providing complete control over the destination path, filename, and file extension.

Recommendations Update to version 7.17.1. As a temporary workaround, disable the ExtractAttachmentsPreprocessor by setting c.ExtractAttachmentsPreprocessor.enabled = False.

Fix

Path traversal

Weakness Enumeration

CWE-73

CWE-22

Related Identifiers

CVE-2026-39377

GHSA-4C99-QJ7H-P3VG

OESA-2026-2195

OESA-2026-2196

OESA-2026-2215

OPENSUSE-SU-2026:10603-1

Affected Products

Nconvert

References · 26

• https://github.com/jupyter/nbconvert/security/advisories/GHSA-4c99-qj7h-p3vg · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-39377 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-39377 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4c99-qj7h-p3vg · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2195 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-39377 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-39378 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-39377 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10603-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-39377 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2196 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2215 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-39377 · Vendor Advisory
• https://github.com/jupyter/nbconvert · Note
• https://github.com/jupyter/nbconvert/releases/tag/v7.17.1 · Note