Path Traversal Vulnerability in Jupyter nbconvert Tool
CVE-2026-39377

6.5MEDIUM

Key Information:

Vendor

Jupyter

Status
Nbconvert
Vendor
CVE Published:
21 April 2026

What is CVE-2026-39377?

The nbconvert tool in Jupyter allows users to convert Jupyter notebooks to multiple formats, but a flaw in versions 6.5 through 7.17.0 enables path traversal attacks. This vulnerability arises when crafted cell attachment filenames are processed, causing the ExtractAttachmentsPreprocessor to write files outside of the intended output directory without proper sanitization. Attackers can manipulate the destination path and file extension, leading to unauthorized file access and potential system compromise. Users are advised to upgrade to version 7.17.1, which includes a patch addressing this issue. For more details, visit the security advisory and release notes linked below.

Affected Version(s)

nbconvert >= 6.5, < 7.17.1

References

https://github.com/jupyter/nbconvert/security/advisories/...
x_refsource_CONFIRM
https://github.com/jupyter/nbconvert/releases/tag/v7.17.1
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.