CVE-2026-39377

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-39377
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-39377.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-39377
Aliases
Downstream
Related
Published
2026-04-21T00:14:59.937Z
Modified
2026-07-15T01:49:07.202764672Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVSS Calculator
Summary
nbconvert has an Arbitrary File Write via Path Traversal in Cell Attachment Filenames
Details

The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions 6.5 through 7.17.0 allow arbitrary file writes to locations outside the intended output directory when processing notebooks containing crafted cell attachment filenames. The ExtractAttachmentsPreprocessor passes attachment filenames directly to the filesystem without sanitization, enabling path traversal attacks. This vulnerability provides complete control over both the destination path and file extension. Version 7.17.1 contains a patch.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-22",
        "CWE-73"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39377.json"
}
References

Affected packages

Git / github.com/jupyter/nbconvert

Affected ranges

Type
GIT
Repo
https://github.com/jupyter/nbconvert
Events
Introduced
8fa95b8756384fd4b29c932f345f8228073bacfa
Fixed
78ed30837a607deab7cf0a12dca072bf3f63417a
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:jupyter:nbconvert:*:*:*:*:*:python:*:*",
    "extracted_events": [
        {
            "introduced": "6.5"
        },
        {
            "fixed": "7.17.1"
        },
        {
            "introduced": "6.5.0"
        }
    ]
}

Affected versions

6.*
6.5
7.*
7.0.0
7.0.0rc0
7.0.0rc1
7.0.0rc2
7.0.0rc3
7.1.0
v7.*
v7.10.0
v7.11.0
v7.12.0
v7.13.0
v7.13.1
v7.14.0
v7.14.1
v7.14.2
v7.15.0
v7.16.0
v7.16.1
v7.16.2
v7.16.3
v7.16.4
v7.16.5
v7.16.6
v7.17.0
v7.2.0
v7.2.1
v7.2.10
v7.2.2
v7.2.3
v7.2.4
v7.2.5
v7.2.6
v7.2.7
v7.2.8
v7.2.9
v7.3.0
v7.3.1
v7.4.0
v7.5.0
v7.6.0
v7.7.0
v7.7.1
v7.7.2
v7.7.3
v7.7.4
v7.8.0
v7.9.0
v7.9.1
v7.9.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-39377.json"