{"id":"GHSA-7jqv-fw35-gmx9","summary":"nbconvert has an Arbitrary File Read via Path Traversal in HTMLExporter Image Embedding","details":"## Summary\n\nWhen `HTMLExporter.embed_images=True`, nbconvert's markdown renderer allows arbitrary file read via path traversal in image references. A malicious notebook can exfiltrate sensitive files from the conversion host by embedding them as base64 data URIs in the output HTML.\n\n## Patches\n\nUpgrade to nbconvert 7.17.1\n\n## Workarounds\n\nDo not enable `HTMLExporter.embed_images` (it is not enabled by default).","aliases":["CVE-2026-39378","PYSEC-2026-2230"],"modified":"2026-07-17T21:15:20.047341579Z","published":"2026-04-21T17:18:53Z","database_specific":{"cwe_ids":["CWE-22","CWE-23"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-04-21T17:18:53Z","nvd_published_at":"2026-04-21T01:16:06Z"},"references":[{"type":"WEB","url":"https://github.com/jupyter/nbconvert/security/advisories/GHSA-7jqv-fw35-gmx9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39378"},{"type":"PACKAGE","url":"https://github.com/jupyter/nbconvert"},{"type":"WEB","url":"https://github.com/jupyter/nbconvert/releases/tag/v7.17.1"}],"affected":[{"package":{"name":"nbconvert","ecosystem":"PyPI","purl":"pkg:pypi/nbconvert"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.0"},{"fixed":"7.17.1"}]}],"versions":["6.5.0","6.5.1","6.5.2","6.5.3","6.5.4","7.0.0","7.0.0rc0","7.0.0rc1","7.0.0rc2","7.0.0rc3","7.1.0","7.10.0","7.11.0","7.12.0","7.13.0","7.13.1","7.14.0","7.14.1","7.14.2","7.15.0","7.16.0","7.16.1","7.16.2","7.16.3","7.16.4","7.16.5","7.16.6","7.17.0","7.2.0","7.2.1","7.2.10","7.2.2","7.2.3","7.2.4","7.2.5","7.2.6","7.2.7","7.2.8","7.2.9","7.3.0","7.3.1","7.4.0","7.5.0","7.6.0","7.7.0","7.7.1","7.7.2","7.7.3","7.7.4","7.8.0","7.9.0","7.9.1","7.9.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-7jqv-fw35-gmx9/GHSA-7jqv-fw35-gmx9.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"}]}