CVE-2026-114140: nbconvert: File write via path traversal in cell output filenames
The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. From 5.4.0 until 7.17.2, ExtractOutputPreprocessor in nbconvert/preprocessors/extractoutput.py joins the attacker-controlled cell output metadata filename to outputfilesdir without limiting the result to the intended directory. When a victim converts a malicious notebook with the markdown, LaTeX, reStructuredText, or AsciiDoc exporter, path traversal in the output filename can write attacker-controlled output data to arbitrary locations accessible to the victim. Running the notebook cell again replaces the malicious output metadata, but merely converting the supplied notebook does not. This issue is fixed in version 7.17.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nbconvertto a version that resolves this vulnerability.Fixed in 7.17.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of nbconvert versions 5.4.0 through 7.17.1 who convert untrusted notebooks with the Markdown, LaTeX, reStructuredText, or AsciiDoc exporter are exposed. The write occurs with the permissions of the user performing the conversion.
What must an attacker provide for exploitation?
An attacker must provide a notebook containing cell output metadata with a filename that uses path traversal. The victim must convert that notebook using one of the affected exporters; executing the notebook is not required.
Are all nbconvert export formats affected?
The provided information identifies the Markdown, LaTeX, reStructuredText, and AsciiDoc exporters as affected. It does not establish impact for other exporters.
What can be done if upgrading is not immediately possible?
Do not convert untrusted notebooks with the affected exporters. If conversion is necessary, perform it in an environment where the converting user cannot write to sensitive locations.
How can a notebook's malicious output metadata be removed?
Running the affected notebook cell again replaces the malicious output metadata. Simply converting the supplied notebook does not remove it.