Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions 6.5 through 7.17.0 allow arbitrary file writes to locations outside the intended output directory when processing notebooks containing crafted cell attachment filenames. The `ExtractAttachmentsPreprocessor` passes attachment filenames directly to the filesystem without sanitization, enabling path traversal attacks. This vulnerability provides complete control over both the destination path and file extension. Version 7.17.1 contains a patch.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-21 | 1 | General1 |
| 2026-04-28 | 1 | Disclosure1 |
| 2026-05-11 | 1 | Patch1 |
| 2026-08-22 | 1 | General1 |
Ejecución de código malicioso Movimiento lateral CVE-2026-39377 https://t.co/509HhtYpqa
Post summary
The post flags CVE‑2026‑39377 as enabling malicious code execution and lateral movement, but offers no detailed technical, patch or exploit information.
OpenHands/OpenHands patched CVE-2026-44897 and CVE-2026-39377 for critical security. Concurrently, Significant-Gravitas/AutoGPT added 5-part concurrent task queues, addressing throughput in autonomous agent execution. ---
Post summary
The post announces that OpenHands/OpenHands has released patches for CVE‑2026‑44897 and CVE‑2026‑39377, highlighting security remediation.
CVE-2026-39377: CVE-2026-39377: Arbitrary File Write via Path Traversal in Jupyter nbconvert Jupyter nbconvert versions 6.5 through 7.17.0 contain a path traversal vulnerability resulting in arbitrary file write capabilities. The `ExtractAttachmentsPr... https://cvereports.com/reports/CVE-2026-39377
Post summary
A new path‑traversal vulnerability (CVE‑2026‑39377) that allows arbitrary file writes has been disclosed for Jupyter nbconvert versions 6.5–7.17.0; no PoC, exploit, patch, or active exploitation details are provided.
🟠 nbconvert, Arbitrary File Write via Path Traversal, #CVE-2026-39377 (Moderate) https://dailycve.com/nbconvert-arbitrary-file-write-via-path-traversal-cve-2026-39377-moderate/
Post summary
The post announces CVE‑2026‑39377 affecting nbconvert, describing a path‑traversal based file write, but offers no details on exploitation, patches, or support code.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | jupyter | nbconvert | - | python | - |