CVE-2026-39378

MEDIUM6.5EPSS 0.04%

nbconvert has an Arbitrary File Read via Path Traversal in HTMLExporter Image Embedding

發布日:2026/4/21修改日:2026/4/30

也稱為:GHSA-7jqv-fw35-gmx9CGA-h45f-r3q7-h5qpDEBIAN-CVE-2026-39378

描述

## Summary When `HTMLExporter.embed_images=True`, nbconvert's markdown renderer allows arbitrary file read via path traversal in image references. A malicious notebook can exfiltrate sensitive files from the conversion host by embedding them as base64 data URIs in the output HTML. ## Patches Upgrade to nbconvert 7.17.1 ## Workarounds Do not enable `HTMLExporter.embed_images` (it is not enabled by default).

受影響套件(2)

Debian/nbconvertfrom 0
PyPI/nbconvert>= 6.5.0, < 7.17.1

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	MEDIUM6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

參考連結(5)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2026-39378
ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2026-39378
PATCHhttps://github.com/jupyter/nbconvert
WEBhttps://github.com/jupyter/nbconvert/releases/tag/v7.17.1
WEBhttps://github.com/jupyter/nbconvert/security/advisories/GHSA-7jqv-fw35-gmx9