PT-2026-33879 · Jupyter · Nconvert

Published 2026-04-21 · Updated 2026-04-21 · CVE-2026-39378

NVD

CVSS v3.1

6.5

Medium

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. In versions 6.5 through 7.17.0, when HTMLExporter.embed images=True, nbconvert's markdown renderer allows arbitrary file read via path traversal in image references. A malicious notebook can exfiltrate sensitive files from the conversion host by embedding them as base64 data URIs in the output HTML. nbconvert 7.17.1 contains a fix. As a workaround, do not enable HTMLExporter.embed images; it is not enabled by default.

Fix

Path traversal

Weakness Enumeration

CWE-73

CWE-22

Related Identifiers

CVE-2026-39378

Affected Products

Nconvert

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-39378 · Security Note
• https://github.com/jupyter/nbconvert/releases/tag/v7.17.1 · Note
• https://github.com/jupyter/nbconvert/security/advisories/GHSA-7jqv-fw35-gmx9 · Note