CVE-2026-39377: fallo de gravedad media en jupyter nbconvert
nbconvert has an Arbitrary File Write via Path Traversal in Cell Attachment Filenames
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.5epss 0.3%
The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions 6.5 through 7.17.0 allow arbitrary file writes to locations outside the intended output directory when processing notebooks containing crafted cell attachment filenames. The `ExtractAttachmentsPreprocessor` passes attachment filenames directly to the filesystem without sanitization, enabling path traversal attacks. This vulnerability provides complete control over both the destination path and file extension. Version 7.17.1 contains a patch.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Productos afectados
jupyter · nbconvertCVEs relacionadas — jupyter nbconvert
En el mismo producto, de las más peligrosas a las menos.
CVE-2021-32862HIGHnbconvert vulnerable to cross-site scripting (XSS) via multiple exploit pathsEPSS 1.5%CVE-2026-114140HIGHnbconvert: File write via path traversal in cell output filenamesEPSS 0.5%CVE-2026-39378MEDIUMnbconvert has an Arbitrary File Read via Path Traversal in HTMLExporter Image EmbeddingEPSS 0.3%CVE-2025-53000HIGHnbconvert has an uncontrolled search path that leads to unauthorized code execution on WindowsEPSS 0.3%