{"cve":"CVE-2026-39377","nvd":{"published":"2026-04-21T01:16:05.937","modified":"2026-10-26T22:10:00.163","status":"Analyzed","description":"The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions 6.5 through 7.17.0 allow arbitrary file writes to locations outside the intended output directory when processing notebooks containing crafted cell attachment filenames. The `ExtractAttachmentsPreprocessor` passes attachment filenames directly to the filesystem without sanitization, enabling path traversal attacks. This vulnerability provides complete control over both the destination path and file extension. Version 7.17.1 contains a patch.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","score":6.5},"cwes":["CWE-22","CWE-73"],"references":["https://github.com/jupyter/nbconvert/releases/tag/v7.17.1","https://github.com/jupyter/nbconvert/security/advisories/GHSA-4c99-qj7h-p3vg"],"products":["jupyter:nbconvert"],"source":"nvd","synced_at":"2026-10-26T22:26:44.656832877+00:00"},"epss":{"cve":"CVE-2026-39377","score":0.00266,"percentile":0.18386,"date":"2026-10-26"},"kev":null,"osv":[{"id":"GHSA-4c99-qj7h-p3vg","url":"https://osv.dev/vulnerability/GHSA-4c99-qj7h-p3vg","summary":"nbconvert has an Arbitrary File Write via Path Traversal in Cell Attachment Filenames","modified":"2026-09-10T03:51:00.940697146Z","packages":[{"ecosystem":"PyPI","name":"nbconvert","purl":"pkg:pypi/nbconvert","ranges":[">=6.5.0 <7.17.1"],"fixed":["7.17.1"]}]},{"id":"PYSEC-2026-2229","url":"https://osv.dev/vulnerability/PYSEC-2026-2229","summary":"","modified":"2026-07-13T07:15:37.671269225Z","packages":[{"ecosystem":"PyPI","name":"nbconvert","purl":"pkg:pypi/nbconvert","ranges":[">=6.5.0 <7.17.1"],"fixed":["7.17.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}