CVE-2026-39377
2 advisories.
PyPI/nbconvert CVE-2026-39377: medium 6.5
nbconvert has an Arbitrary File Write via Path Traversal in Cell Attachment Filenames
Action: Upgrade nbconvert to 7.17.1 or later.
pip install nbconvert==7.17.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 6.5.0 | 7.17.1 | - |
Fixed versions
| 7.17.1 |
Sources
- osv: GHSA-4c99-qj7h-p3vg
- https://github.com/jupyter/nbconvert/security/advisories/GHSA-4c99-qj7h-p3vg
- https://nvd.nist.gov/vuln/detail/CVE-2026-39377
- https://github.com/jupyter/nbconvert
- https://github.com/jupyter/nbconvert/releases/tag/v7.17.1
CVE-2026-39377 · published · modified · JSON
PyPI/nbconvert CVE-2026-39377: medium 6.5
The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions 6.5 through 7.17.0 allow arbitrary file writes to locations outside the intende
Action: Upgrade nbconvert to 7.17.1 or later.
pip install nbconvert==7.17.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 6.5.0 | 7.17.1 | - |
Fixed versions
| 7.17.1 |
Sources
- osv: PYSEC-2026-2229
- https://github.com/jupyter/nbconvert/releases/tag/v7.17.1
- https://github.com/jupyter/nbconvert/security/advisories/GHSA-4c99-qj7h-p3vg
CVE-2026-39377 · published · modified · JSON