p PatchFirst

CVE-2026-39378

CVE-2026-39378 · nbconvert has an Arbitrary File Read via Path Traversal in HTMLExporter Image Embedding

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. In versions 6.5 through 7.17.0, when `HTMLExporter.embed_images=True`, nbconvert's markdown renderer allows arbitrary file read via path traversal in image references. A malicious notebook can exfiltrate sensitive files from the conversion host by embedding them as base64 data URIs in the output HTML. nbconvert 7.17.1 contains a fix. As a workaround, do not enable `HTMLExporter.embed_images`; it is not enabled by default.

CVSS 6.5 · Medium · EPSS 0.5% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • nbconvert

    Versions
    • >= 6.5, < 7.17.1: Affected

    No fix published

  • nbconvert Debian:12

    Versions
    • 6.5.3-3
    • 6.5.3-4
    • 6.5.3-5
    • 7.16.4-1
    • 7.16.4-2
    • 7.16.5-1
    • 7.16.6-1
    • 7.17.0-1
    • 7.17.1-1
    • 7.17.1-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nbconvert Debian:13

    Versions
    • 7.16.6-1
    Affected ranges
    • ECOSYSTEM: < 7.16.6-1+deb13u1

    Update to 7.16.6-1+deb13u1

  • nbconvert Debian:14

    Versions
    • 7.16.6-1
    • 7.17.0-1
    Affected ranges
    • ECOSYSTEM: < 7.17.1-1

    Update to 7.17.1-1

  • nbconvert PyPI

    Versions
    • 6.5.0
    • 6.5.1
    • 6.5.2
    • 6.5.3
    • 6.5.4
    • 7.0.0
    • 7.0.0rc0
    • 7.0.0rc1
    • 7.0.0rc2
    • 7.0.0rc3
    • 7.1.0
    • 7.10.0
    • 7.11.0
    • 7.12.0
    • 7.13.0
    • 7.13.1
    • 7.14.0
    • 7.14.1
    • 7.14.2
    • 7.15.0
    • 7.16.0
    • 7.16.1
    • 7.16.2
    • 7.16.3
    • 7.16.4
    • 7.16.5
    • 7.16.6
    • 7.17.0
    • 7.2.0
    • 7.2.1
    • 7.2.10
    • 7.2.2
    • 7.2.3
    • 7.2.4
    • 7.2.5
    • 7.2.6
    • 7.2.7
    • 7.2.8
    • 7.2.9
    • 7.3.0
    • 7.3.1
    • 7.4.0
    • 7.5.0
    • 7.6.0
    • 7.7.0
    • 7.7.1
    • 7.7.2
    • 7.7.3
    • 7.7.4
    • 7.8.0
    • 7.9.0
    • 7.9.1
    • 7.9.2
    Affected ranges
    • ECOSYSTEM: ≥ 6.5.0, < 7.17.1

    Update to 7.17.1

  • nbconvert Ubuntu:18.04:LTS

    Versions
    • 4.2.0-4
    • 5.3.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nbconvert Ubuntu:20.04:LTS

    Versions
    • 5.4-2ubuntu2
    • 5.6.0-1
    • 5.6.0-2
    • 5.6.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nbconvert Ubuntu:22.04:LTS

    Versions
    • 5.6.1-3
    • 6.1.0-1
    • 6.3.0-1
    • 6.4.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nbconvert Ubuntu:24.04:LTS

    Versions
    • 6.5.3-4
    • 6.5.3-5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nbconvert Ubuntu:25.10

    Versions
    • 7.16.6-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nbconvert Ubuntu:26.10

    Versions
    • 7.17.0-1
    • 7.17.1-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nbconvert Ubuntu:26.04:LTS

    Versions
    • 7.16.6-1
    • 7.17.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →