{"action":"Upgrade nbconvert to 7.17.2 or later.","affected":[{"fixed":"7.17.2","introduced":"5.4.0"}],"component":"nbconvert","cve_ids":["CVE-2026-114140"],"ecosystem":"PyPI","exploited":false,"fixed_versions":["7.17.2"],"ghsa_id":"GHSA-pjvx-prjx-h659","id":"tcs_01M5JMCYAZWJJN693TPBNSXR57","modified_at":"2026-10-22T16:30:41.002101482Z","published_at":"2026-10-22T16:23:28Z","references":["https://osv.dev/vulnerability/GHSA-pjvx-prjx-h659","https://github.com/jupyter/nbconvert/security/advisories/GHSA-pjvx-prjx-h659","https://nvd.nist.gov/vuln/detail/CVE-2026-114140","https://github.com/jupyter/nbconvert/commit/ce4bd99aec31d81d759fa8eeb8643179392ec66f","https://github.com/jupyter/nbconvert","https://github.com/jupyter/nbconvert/releases/tag/v7.17.2"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-pjvx-prjx-h659","url":"https://osv.dev/vulnerability/GHSA-pjvx-prjx-h659"},{"source":"nvd","source_id":"CVE-2026-114140","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114140"}],"summary":"nbconvert: Arbitrary file write through path traversal in cell output filenames when exporting to md, latex, rst and asciidoc"}