GHSA-pjvx-prjx-h659: Path Traversal
Summary
nbconvert <= v7.17.1 has an arbitrary file write vulnerability due to a path traversal in ipynb cell output metadata, more specifically on the filename attribute.
Vulnerable converters : --to markdown, --to latex, --to rst, --to asciidoc.
In ExtractOutputPreprocessor, extractoutput.py:116-119 joins attacker-controlled path to outputfilesdir with no canonicalization check, enabling arbitrary file write.
This is a sibling vulnerability of https://github.com/advisories/GHSA-4c99-qj7h-p3vg.
Impact
If a victim runs nbconvert on a malicious ipynb file, it can create some files with arbitrary data in arbitrary locations, i.e. override authorizedkeys.
Note that running the cell with jupyter overrides the output, so it would "clean up" malicious cells.
PoC
In a ipynb file:
json
"cells": [{ "celltype": "code", "id": "abc123", "executioncount": 1, "metadata": {}, "source": "# PoC", "outputs": [{ "outputtype": "displaydata", "metadata": { "filename": "../../../tmp/PWNED.png" # ← traverses outside outputdir }, "data": { # minimal valid PNG (1×1 pixel) "image/png": "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==" } }] }]
Patches
Fixed in - https://github.com/jupyter/nbconvert/commit/ce4bd99aec31d81d759fa8eeb8643179392ec66f - 7.17.2
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/nbconvertto a version that resolves this vulnerability.Fixed in 7.17.2 - Upgrade
Upgrade
jupyter/nbconvertto a version that resolves this vulnerability.Fixed in 7.17.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users running nbconvert version 7.17.1 or earlier are exposed when they convert an attacker-controlled notebook to Markdown, LaTeX, reStructuredText, or AsciiDoc. The malicious content is carried in a cell output's metadata filename attribute.
What must an attacker do to exploit it?
An attacker must provide a crafted .ipynb file and persuade a victim to run one of the affected nbconvert conversion modes on it. The crafted filename can use path traversal sequences to write output outside the intended output directory.
What is the practical impact of a successful exploit?
The conversion can create files containing attacker-controlled data at arbitrary locations that the converting user is permitted to write. The advisory specifically notes that this could be used to overwrite authorized_keys.
How can I determine whether a notebook may be malicious?
Inspect cell outputs for a metadata filename value containing traversal components such as ../, particularly in display_data outputs containing extracted file content. Running the notebook's cell in Jupyter overwrites its output and can remove the malicious cell output.