Log in Start free

Vulnerability · Published Apr 21, 2026 · Assigned by GitHub_M

CVE-2026-39378nbconvert has an Arbitrary File Read via Path Traversal in HTMLExporter Image Embedding

Medium 6.5

In plain English

A medium-severity path traversal in nbconvert from jupyter. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.3%top 76.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. In versions 6.5 through 7.17.0, when `HTMLExporter.embed_images=True`, nbconvert's markdown renderer allows arbitrary file read via path traversal in image references. A malicious notebook can exfiltrate sensitive files from the conversion host by embedding them as base64 data URIs in the output HTML. nbconvert 7.17.1 contains a fix. As a workaround, do not enable `HTMLExporter.embed_images`; it is not enabled by default.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12nbconvertno fix listedDEBIAN-CVE-2026-39378
Debian:13nbconvert7.16.6-1+deb13u1DEBIAN-CVE-2026-39378
Debian:14nbconvert7.17.1-1DEBIAN-CVE-2026-39378
PyPInbconvert7.17.1GHSA-7jqv-fw35-gmx9
PyPInbconvert7.17.1PYSEC-2026-2230
Ubuntu:22.04:LTSnbconvertno fix listedUBUNTU-CVE-2026-39378
Ubuntu:24.04:LTSnbconvertno fix listedUBUNTU-CVE-2026-39378
Ubuntu:25.10nbconvertno fix listedUBUNTU-CVE-2026-39378
Ubuntu:26.04:LTSnbconvertno fix listedUBUNTU-CVE-2026-39378
Ubuntu:26.10nbconvertno fix listedUBUNTU-CVE-2026-39378

Affected products (as reported)

VendorProductVersions
jupyter nbconvert >= 6.5, < 7.17.1

Weakness: CWE-22, CWE-73 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References