Project Jupyter nbconvert: Path traversal leads to arbitrary file write
Summary
nbconvert converts Jupyter notebooks to other formats. In the markdown, LaTeX, reStructuredText and AsciiDoc exporters, output filenames from cell output metadata are joined to the output directory without validation. A malicious notebook can therefore cause files with attacker-controlled data to be written to arbitrary locations accessible to the user running the conversion. Exploitation requires a victim to convert an attacker-supplied notebook; merely running the cell again replaces the malicious metadata, but converting the notebook does not.
Affected
- nbconvert 5.4.0 up to, but not including, 7.17.2
- Only the markdown, LaTeX, reStructuredText and AsciiDoc exporters are affected
- Note: version 7.17.1 is also affected; it was a separate security release for other CVEs
Fixed in
- Fixed in nbconvert 7.17.2 (fix commit ce4bd99)
Workaround
- No official workaround is published.
- Until the upgrade is done, do not convert notebooks from untrusted sources with the markdown, LaTeX, reStructuredText or AsciiDoc exporters.
Exploitation
- No evidence of exploitation in the wild found; not listed as known exploited.
- A public proof of concept is described in the GitHub advisory; not reproduced by us.
- CISA SSVC: exploitation status PoC, automatable: no, technical impact: total.
Our recommendation
- Inventory all Python environments, lockfiles and containers for nbconvert, including transitive dependencies.
- Upgrade to nbconvert 7.17.2 or later and verify that the new version is actually deployed.
- Until then, avoid converting untrusted notebooks with the affected exporters.
- Prioritise systems such as JupyterHub, data-science workstations and documentation build pipelines that process external notebooks.
- Monitor the GitHub advisory and NVD for updated scoring.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-pjvx-prjx-h659 github.com
- nbconvert release v7.17.2 github.com
- Fix commit ce4bd99 github.com
- GitLab Advisory CVE-2026-114140 advisories.gitlab.com
- Ubuntu Security CVE-2026-114140 ubuntu.com
- OSV GHSA-pjvx-prjx-h659 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 11:06.
Original description (NVD)
The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. From 5.4.0 until 7.17.2, ExtractOutputPreprocessor in nbconvert/preprocessors/extractoutput.py joins the attacker-controlled cell output metadata filename to output_files_dir without limiting the result to the intended directory. When a victim converts a malicious notebook with the markdown, LaTeX, reStructuredText, or AsciiDoc exporter, path traversal in the output filename can write attacker-controlled output data to arbitrary locations accessible to the victim. Running the notebook cell again replaces the malicious output metadata, but merely converting the supplied notebook does not. This issue is fixed in version 7.17.2.
NVD references (4)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.