Medium
nbconvert — security advisory
The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions 6.5 through 7.17.0 allow arbitrary file writes to locations outside the intended output directory when processing notebooks containing crafted cell attachment filenames. The `ExtractAttachmentsPreprocessor` passes attachment filenames directly to the filesystem without sanitization, enabling path traversal attacks. This vulnerability provides complete control over both the destination path and file extension. Version 7.17.1 contains a patch.
- Products
- nbconvert
- Affected versions
- 4.2.0-4, 5.3.1-1, 5.4-2ubuntu2, 5.6.0-1, 5.6.0-2, 5.6.1-1, 5.6.1-3, 6.1.0-1, 6.3.0-1, 6.4.0-1, 6.5.3-4, 6.5.3-5, 7.16.6-1, 7.17.0-1, 7.17.1-2
- Fixed versions
- Not specified
- CVEs
- CVE-2026-39377
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 03:02 UTC · Revision 1
Source evidence
The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions 6.5 through 7.17.0 allow arbitrary file writes to locations outside the intended output directory when processing notebooks containing crafted cell attachment filenames. The `ExtractAttachmentsPreprocessor` passes attachment filenames directly to the filesystem without sanitization, enabling path traversal attacks. This vulnerability provides complete control over both the destination path and file extension. Version 7.17.1 contains a patch.
osv:UBUNTU-CVE-2026-39377
nbconvert
Fixed versions: Not specified
nbconvert
Fixed versions: Not specified
nbconvert
Fixed versions: Not specified
nbconvert
Fixed versions: Not specified
nbconvert
Fixed versions: Not specified
nbconvert
Fixed versions: Not specified
nbconvert
Fixed versions: Not specified
Complete source record
{
"id": "a841803df28e8626e8b43fdc67bd2e77b5231085afb452084a2e68bd786e19ce",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-39377",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2026-39377",
"summary": "The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions 6.5 through 7.17.0 allow arbitrary file writes to locations outside the intended output directory when processing notebooks containing crafted cell attachment filenames. The `ExtractAttachmentsPreprocessor` passes attachment filenames directly to the filesystem without sanitization, enabling path traversal attacks. This vulnerability provides complete control over both the destination path and file extension. Version 7.17.1 contains a patch.",
"evidence": "osv:UBUNTU-CVE-2026-39377",
"products": [
{
"name": {
"value": "nbconvert",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "4.2.0-4",
"evidence": "/affected/0/versions"
},
{
"value": "5.3.1-1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "nbconvert",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "5.4-2ubuntu2",
"evidence": "/affected/1/versions"
},
{
"value": "5.6.0-1",
"evidence": "/affected/1/versions"
},
{
"value": "5.6.0-2",
"evidence": "/affected/1/versions"
},
{
"value": "5.6.1-1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "nbconvert",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "5.6.1-3",
"evidence": "/affected/2/versions"
},
{
"value": "6.1.0-1",
"evidence": "/affected/2/versions"
},
{
"value": "6.3.0-1",
"evidence": "/affected/2/versions"
},
{
"value": "6.4.0-1",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "nbconvert",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "6.5.3-4",
"evidence": "/affected/3/versions"
},
{
"value": "6.5.3-5",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "nbconvert",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "7.16.6-1",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "nbconvert",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "7.17.0-1",
"evidence": "/affected/5/versions"
},
{
"value": "7.17.1-2",
"evidence": "/affected/5/versions"
}
]
},
{
"name": {
"value": "nbconvert",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "7.16.6-1",
"evidence": "/affected/6/versions"
},
{
"value": "7.17.0-1",
"evidence": "/affected/6/versions"
}
]
}
],
"severity": "medium",
"structured": {
"id": "UBUNTU-CVE-2026-39377",
"aliases": [
"UBUNTU-CVE-2026-39377"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "nbconvert",
"purl": "pkg:deb/ubuntu/nbconvert?arch=source&distro=bionic",
"ecosystem": "Ubuntu:18.04:LTS"
},
"versions": [
"4.2.0-4",
"5.3.1-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-39377.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "jupyter-nbconvert",
"binary_version": "5.3.1-1"
},
{
"binary_name": "python-nbconvert",
"binary_version": "5.3.1-1"
},
{
"binary_name": "python3-nbconvert",
"binary_version": "5.3.1-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "nbconvert",
"purl": "pkg:deb/ubuntu/nbconvert?arch=source&distro=focal",
"ecosystem": "Ubuntu:20.04:LTS"
},
"versions": [
"5.4-2ubuntu2",
"5.6.0-1",
"5.6.0-2",
"5.6.1-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-39377.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "jupyter-nbconvert",
"binary_version": "5.6.1-1"
},
{
"binary_name": "python3-nbconvert",
"binary_version": "5.6.1-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "nbconvert",
"purl": "pkg:deb/ubuntu/nbconvert?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"5.6.1-3",
"6.1.0-1",
"6.3.0-1",
"6.4.0-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-39377.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "jupyter-nbconvert",
"binary_version": "6.4.0-1"
},
{
"binary_name": "python3-nbconvert",
"binary_version": "6.4.0-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "nbconvert",
"purl": "pkg:deb/ubuntu/nbconvert?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"6.5.3-4",
"6.5.3-5"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-39377.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "jupyter-nbconvert",
"binary_version": "6.5.3-5"
},
{
"binary_name": "python3-nbconvert",
"binary_version": "6.5.3-5"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "nbconvert",
"purl": "pkg:deb/ubuntu/nbconvert?arch=source&distro=questing",
"ecosystem": "Ubuntu:25.10"
},
"versions": [
"7.16.6-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-39377.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "jupyter-nbconvert",
"binary_version": "7.16.6-1"
},
{
"binary_name": "python3-nbconvert",
"binary_version": "7.16.6-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "nbconvert",
"purl": "pkg:deb/ubuntu/nbconvert?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"7.17.0-1",
"7.17.1-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-39377.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "jupyter-nbconvert",
"binary_version": "7.17.1-2"
},
{
"binary_name": "python3-nbconvert",
"binary_version": "7.17.1-2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "nbconvert",
"purl": "pkg:deb/ubuntu/nbconvert?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"7.16.6-1",
"7.17.0-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-39377.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "jupyter-nbconvert",
"binary_version": "7.17.0-1"
},
{
"binary_name": "python3-nbconvert",
"binary_version": "7.17.0-1"
}
]
}
}
],
"modified": "2026-10-17T13:00:02.765405897Z",
"provider": "osv",
"upstream": [
"CVE-2026-39377"
],
"references": [
"https://ubuntu.com/security/CVE-2026-39377",
"https://www.cve.org/CVERecord?id=CVE-2026-39377",
"https://github.com/jupyter/nbconvert/security/advisories/GHSA-4c99-qj7h-p3vg"
]
},
"related_cves": [
{
"value": "CVE-2026-39377",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 360186,
"published_at": "2026-04-21T01:16:00+00:00"
}