nbconvert: Arbitrary file write via path traversal in cell output filenames when exporting notebooks (CVE-2026-114140)
Severity: high · Patch status: patched · Since 2026-10-12 · CVE-2026-114140
nbconvert <= 7.17.1 contains a path traversal vulnerability in ExtractOutputPreprocessor (extractoutput.py:116-119), where attacker-controlled 'filename' metadata in ipynb cell outputs is joined to outputfilesdir without canonicalization checks. A victim who runs nbconvert on a malicious notebook with --to markdown, latex, rst, or asciidoc can have arbitrary files written with attacker-controlled content anywhere the process can reach, e.g. overwriting ~/.ssh/authorizedkeys. A public PoC notebook is included in the advisory; no in-the-wild exploitation is reported. It is a sibling of GHSA-4c99-qj7h-p3vg. Fixed in nbconvert 7.17.2 (commit ce4bd99). Note that re-running cells in Jupyter overwrites outputs, which can clean malicious metadata.
What to do
- Upgrade nbconvert to 7.17.2 or later wherever it is installed or pinned in CI, pipelines, and hosted notebook services
- Audit any pipeline that converts untrusted or third-party .ipynb files with --to markdown/latex/rst/asciidoc and treat such notebooks as untrusted input until patched
- Check systems that processed untrusted notebooks for unexpected or modified files (e.g. authorized_keys, cron/systemd units, startup scripts)
- If immediate upgrade is not possible, disable or sandbox nbconvert jobs on untrusted notebooks, or strip output metadata (including 'filename') from notebooks before conversion
Fixed versions
Sources
All live incidents on Threat Watch
