PT-2026-33879 · Nbconvert · Nconvert

Published 2026-04-21 · Updated 2026-05-09 · CVE-2026-39378

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions nbconvert versions 6.5 through 7.17.0

Description The nbconvert tool converts Jupyter notebooks to various formats using Jinja templates. When the HTMLExporter.embed images variable is set to True, the markdown renderer allows arbitrary file read through path traversal in image references. This allows a malicious notebook to exfiltrate sensitive files from the conversion host by embedding them as base64 data URIs in the output HTML.

Recommendations Update to version 7.17.1. As a temporary workaround, do not enable the HTMLExporter.embed images variable.

Fix

Relative Path Traversal

Path traversal

Weakness Enumeration

CWE-23

CWE-22

CWE-73

Related Identifiers

CVE-2026-39378

GHSA-7JQV-FW35-GMX9

OESA-2026-2195

OESA-2026-2196

OESA-2026-2215

OPENSUSE-SU-2026:10603-1

Affected Products

Nconvert

References · 25

• https://github.com/jupyter/nbconvert/security/advisories/GHSA-7jqv-fw35-gmx9 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-39378 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-39378 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10603-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2215 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-39378 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2195 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39377 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-39378 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7jqv-fw35-gmx9 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-39378 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39378 · Security Note
• https://osv.dev/vulnerability/OESA-2026-2196 · Vendor Advisory
• https://github.com/jupyter/nbconvert · Note
• https://github.com/jupyter/nbconvert/releases/tag/v7.17.1 · Note