DEBIAN-CVE-2026-39377
The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions 6.5 through 7.17.0 allow arbitrary file writes to locations outside the intended output directory when processing notebooks containing crafted cell attachment filenames. The `ExtractAttachmentsPreprocessor` passes attachment filenames directly to the filesystem without sanitization, enabling path traversal attacks. This vulnerability provides complete control over both the destination path and file extension. Version 7.17.1 contains a patch.
DEBIAN-CVE-2026-39377
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-39377
nbconvert
Source reference: /affected/0/package/name
- Affected versions
- 7.16.6-1
Source reference:
/affected/0/versions - Fixed versions
- 7.16.6-1+deb13u1
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
nbconvert
Source reference: /affected/1/package/name
- Affected versions
- 7.16.6-1
Source reference:
/affected/1/versions7.17.0-1Source reference:
/affected/1/versions - Fixed versions
- 7.17.1-1
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.16.6-1+deb13u1"
}
]
}
],
"package": {
"name": "nbconvert",
"purl": "pkg:deb/debian/nbconvert?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"7.16.6-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-39377.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.17.1-1"
}
]
}
],
"package": {
"name": "nbconvert",
"purl": "pkg:deb/debian/nbconvert?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"7.16.6-1",
"7.17.0-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-39377.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #56892 · Revision 1
- Added to Heist Feed
- Publisher date