Unauthorized Code Execution in Jupyter nbconvert on Windows

CVE-2025-53000

What is CVE-2025-53000?

The nbconvert tool, used for converting Jupyter notebooks to various formats, is susceptible to a vulnerability when handling SVG output on Windows systems. This issue allows a malicious third party to create an inkscape.bat file within a directory containing a notebook. When a user executes the command jupyter nbconvert --to pdf on such a notebook, the inkscape.bat file is triggered, leading to arbitrary code execution. As of now, no patches have been released to address this vulnerability, highlighting an important security concern for users operating on Windows.

References