CVE-2026-39378: fallo de gravedad media en jupyter nbconvert
nbconvert has an Arbitrary File Read via Path Traversal in HTMLExporter Image Embedding
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.5epss 0.3%
The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. In versions 6.5 through 7.17.0, when `HTMLExporter.embed_images=True`, nbconvert's markdown renderer allows arbitrary file read via path traversal in image references. A malicious notebook can exfiltrate sensitive files from the conversion host by embedding them as base64 data URIs in the output HTML. nbconvert 7.17.1 contains a fix. As a workaround, do not enable `HTMLExporter.embed_images`; it is not enabled by default.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Productos afectados
jupyter · nbconvertCVEs relacionadas — jupyter nbconvert
En el mismo producto, de las más peligrosas a las menos.
CVE-2021-32862HIGHnbconvert vulnerable to cross-site scripting (XSS) via multiple exploit pathsEPSS 1.5%CVE-2026-114140HIGHnbconvert: File write via path traversal in cell output filenamesEPSS 0.5%CVE-2026-39377MEDIUMnbconvert has an Arbitrary File Write via Path Traversal in Cell Attachment FilenamesEPSS 0.3%CVE-2025-53000HIGHnbconvert has an uncontrolled search path that leads to unauthorized code execution on WindowsEPSS 0.3%