GHSA-PJVX-PRJX-H659
Vulnerability from github – Published: 2026-10-22 16:23 – Updated: 2026-10-22 16:23Summary
nbconvert <= v7.17.1 has an arbitrary file write vulnerability due to a path traversal in ipynb cell output metadata, more specifically on the filename attribute.
Vulnerable converters : --to markdown, --to latex, --to rst, --to asciidoc.
In ExtractOutputPreprocessor, extractoutput.py:116-119 joins attacker-controlled path to output_files_dir with no canonicalization check, enabling arbitrary file write.
This is a sibling vulnerability of https://github.com/advisories/GHSA-4c99-qj7h-p3vg.
Impact
If a victim runs nbconvert on a malicious ipynb file, it can create some files with arbitrary data in arbitrary locations, i.e. override authorized_keys.
Note that running the cell with jupyter overrides the output, so it would "clean up" malicious cells.
PoC
In a ipynb file:
"cells": [{
"cell_type": "code", "id": "abc123", "execution_count": 1,
"metadata": {}, "source": "# PoC",
"outputs": [{
"output_type": "display_data",
"metadata": {
"filename": "../../../tmp/PWNED.png" # ← traverses outside output_dir
},
"data": {
# minimal valid PNG (1×1 pixel)
"image/png": "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg=="
}
}]
}]
Patches
Fixed in - https://github.com/jupyter/nbconvert/commit/ce4bd99aec31d81d759fa8eeb8643179392ec66f - 7.17.2
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 7.17.1"
},
"package": {
"ecosystem": "PyPI",
"name": "nbconvert"
},
"ranges": [
{
"events": [
{
"introduced": "5.4.0"
},
{
"fixed": "7.17.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-114140"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-22T16:23:28Z",
"nvd_published_at": "2026-10-21T21:17:56Z",
"severity": "HIGH"
},
"details": "### Summary\n\nnbconvert \u003c= v7.17.1 has an arbitrary file write vulnerability due to a path traversal in ipynb cell output metadata, more specifically on the filename attribute.\n\nVulnerable converters : `--to markdown`, `--to latex`, `--to rst`, `--to asciidoc`.\n\nIn `ExtractOutputPreprocessor`, `extractoutput.py:116-119` joins attacker-controlled `path` to `output_files_dir` with no canonicalization check, enabling arbitrary file write.\n\nThis is a sibling vulnerability of https://github.com/advisories/GHSA-4c99-qj7h-p3vg.\n\n### Impact\n\nIf a victim runs nbconvert on a malicious ipynb file, it can create some files with arbitrary data in arbitrary locations, i.e. override authorized_keys.\n\nNote that running the cell with jupyter overrides the output, so it would \"clean up\" malicious cells.\n\n### PoC\n\nIn a ipynb file:\n\n```json\n\n\"cells\": [{\n \"cell_type\": \"code\", \"id\": \"abc123\", \"execution_count\": 1,\n \"metadata\": {}, \"source\": \"# PoC\",\n \"outputs\": [{\n \"output_type\": \"display_data\",\n \"metadata\": {\n \"filename\": \"../../../tmp/PWNED.png\" # \u2190 traverses outside output_dir\n },\n \"data\": {\n # minimal valid PNG (1\u00d71 pixel)\n \"image/png\": \"iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==\"\n }\n }]\n }]\n\n```\n\n\n### Patches\n\nFixed in \n- https://github.com/jupyter/nbconvert/commit/ce4bd99aec31d81d759fa8eeb8643179392ec66f\n- [7.17.2](https://github.com/jupyter/nbconvert/releases/tag/v7.17.2)",
"id": "GHSA-pjvx-prjx-h659",
"modified": "2026-10-22T16:23:28Z",
"published": "2026-10-22T16:23:28Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/jupyter/nbconvert/security/advisories/GHSA-pjvx-prjx-h659"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114140"
},
{
"type": "WEB",
"url": "https://github.com/jupyter/nbconvert/commit/ce4bd99aec31d81d759fa8eeb8643179392ec66f"
},
{
"type": "PACKAGE",
"url": "https://github.com/jupyter/nbconvert"
},
{
"type": "WEB",
"url": "https://github.com/jupyter/nbconvert/releases/tag/v7.17.2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"type": "CVSS_V4"
}
],
"summary": "nbconvert: Arbitrary file write through path traversal in cell output filenames when exporting to md, latex, rst and asciidoc"
}
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.