Source: nbconvert X-Debbugs-CC: [email protected] Severity: grave Tags: security
Hi, The following vulnerability was published for nbconvert. CVE-2026-114140[0]: | The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to | various other formats via Jinja templates. From 5.4.0 until 7.17.2, | ExtractOutputPreprocessor in | nbconvert/preprocessors/extractoutput.py joins the attacker- | controlled cell output metadata filename to output_files_dir without | limiting the result to the intended directory. When a victim | converts a malicious notebook with the markdown, LaTeX, | reStructuredText, or AsciiDoc exporter, path traversal in the output | filename can write attacker-controlled output data to arbitrary | locations accessible to the victim. Running the notebook cell again | replaces the malicious output metadata, but merely converting the | supplied notebook does not. This issue is fixed in version 7.17.2. https://github.com/jupyter/nbconvert/security/advisories/GHSA-pjvx-prjx-h659 Fixed by: https://github.com/jupyter/nbconvert/commit/ce4bd99aec31d81d759fa8eeb8643179392ec66f (v7.17.2) If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-114140 https://www.cve.org/CVERecord?id=CVE-2026-114140 Please adjust the affected versions in the BTS as needed.
