Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. In versions 6.5 through 7.17.0, when `HTMLExporter.embed_images=True`, nbconvert's markdown renderer allows arbitrary file read via path traversal in image references. A malicious notebook can exfiltrate sensitive files from the conversion host by embedding them as base64 data URIs in the output HTML. nbconvert 7.17.1 contains a fix. As a workaround, do not enable `HTMLExporter.embed_images`; it is not enabled by default.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-21 | 1 | General1 |
| 2026-04-28 | 1 | Disclosure1 |
CVE-2026-39378 The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. In versions 6.5 through 7.17.0, when `HTMLExporter.emb… https://www.cve.org/CVERecord?id=CVE-2026-39378
Post summary
The snippet merely states the existence of CVE-2026-39378 affecting nbconvert across a range of versions, without providing further details such as exploit code, active use, or vendor remediation.
CVE-2026-39378: CVE-2026-39378: Arbitrary File Read via Path Traversal in Jupyter nbconvert Jupyter nbconvert versions 6.5 through 7.17.0 contain a path traversal vulnerability. When the HTMLExporter.embed_images configuration is enabled, the markdown... https://cvereports.com/reports/CVE-2026-39378
Post summary
The snippet discloses a path‑traversal flaw in Jupyter nbconvert that permits arbitrary file reads, but no PoC, exploit code, patch notice, or active exploitation is discussed.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | jupyter | nbconvert | - | python | - |