DEBIAN-CVE-2025-53000

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2025-53000
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-53000.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2025-53000
Upstream
Withdrawn
2025-12-27T19:45:46.348260Z
Published
2025-12-17T21:16:14.473Z
Modified
2025-12-27T19:45:46.348260Z
Severity
  • 8.5 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
Summary
[none]
Details

The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions of nbconvert up to and including 7.16.6 on Windows have a vulnerability in which converting a notebook containing SVG output to a PDF results in unauthorized code execution. Specifically, a third party can create a inkscape.bat file that defines a Windows batch script, capable of arbitrary code execution. When a user runs jupyter nbconvert --to pdf on a notebook containing SVG output to a PDF on a Windows platform from this directory, the inkscape.bat file is run unexpectedly. As of time of publication, no known patches exist.

References

Affected packages

Debian:11 / nbconvert

Package

Name
nbconvert
Purl
pkg:deb/debian/nbconvert?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

5.*
5.6.1-3
5.6.1-3+deb11u1
6.*
6.1.0-1
6.3.0-1
6.4.0-1
6.4.4-1
6.4.4-2
6.5.1-1
6.5.3-1
6.5.3-1.1
6.5.3-2
6.5.3-3
6.5.3-4
6.5.3-5
7.*
7.16.4-1
7.16.4-2
7.16.5-1
7.16.6-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-53000.json"

Debian:12 / nbconvert

Package

Name
nbconvert
Purl
pkg:deb/debian/nbconvert?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

6.*
6.5.3-3
6.5.3-4
6.5.3-5
7.*
7.16.4-1
7.16.4-2
7.16.5-1
7.16.6-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-53000.json"

Debian:13 / nbconvert

Package

Name
nbconvert
Purl
pkg:deb/debian/nbconvert?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

7.*
7.16.6-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-53000.json"

Debian:14 / nbconvert

Package

Name
nbconvert
Purl
pkg:deb/debian/nbconvert?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

7.*
7.16.6-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-53000.json"