CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-39377

The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions 6.5 through 7.17.0 allow arbitrary file writes to locations outside the intended output directory when processing notebooks containing crafted cell attachment filenames. The `ExtractAttachmentsPreprocessor` passes attachment filenames directly to the filesystem without sanitization, enabling path traversal attacks. This vulnerability provides complete control over both the destination path and file extension. Version 7.17.1 contains a patch.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.0

EPSS Ranking 14.4%

CVSS Severity

CVSS v3 Score 6.5

References

Products affected by CVE-2026-39377

Jupyter » Nbconvert » Version: 6.5.0

cpe:2.3:a:jupyter:nbconvert:6.5.0
Jupyter » Nbconvert » Version: 6.5.1

cpe:2.3:a:jupyter:nbconvert:6.5.1
Jupyter » Nbconvert » Version: 6.5.2

cpe:2.3:a:jupyter:nbconvert:6.5.2
Jupyter » Nbconvert » Version: 6.5.3

cpe:2.3:a:jupyter:nbconvert:6.5.3
Jupyter » Nbconvert » Version: 7.0.0

cpe:2.3:a:jupyter:nbconvert:7.0.0
Jupyter » Nbconvert » Version: 7.1.0

cpe:2.3:a:jupyter:nbconvert:7.1.0
Jupyter » Nbconvert » Version: 7.10.0

cpe:2.3:a:jupyter:nbconvert:7.10.0
Jupyter » Nbconvert » Version: 7.11.0

cpe:2.3:a:jupyter:nbconvert:7.11.0
Jupyter » Nbconvert » Version: 7.12.0

cpe:2.3:a:jupyter:nbconvert:7.12.0
Jupyter » Nbconvert » Version: 7.13.0

cpe:2.3:a:jupyter:nbconvert:7.13.0
Jupyter » Nbconvert » Version: 7.13.1

cpe:2.3:a:jupyter:nbconvert:7.13.1
Jupyter » Nbconvert » Version: 7.14.0

cpe:2.3:a:jupyter:nbconvert:7.14.0
Jupyter » Nbconvert » Version: 7.14.1

cpe:2.3:a:jupyter:nbconvert:7.14.1
Jupyter » Nbconvert » Version: 7.14.2

cpe:2.3:a:jupyter:nbconvert:7.14.2
Jupyter » Nbconvert » Version: 7.15.0

cpe:2.3:a:jupyter:nbconvert:7.15.0
Jupyter » Nbconvert » Version: 7.16.0

cpe:2.3:a:jupyter:nbconvert:7.16.0
Jupyter » Nbconvert » Version: 7.16.1

cpe:2.3:a:jupyter:nbconvert:7.16.1
Jupyter » Nbconvert » Version: 7.16.2

cpe:2.3:a:jupyter:nbconvert:7.16.2
Jupyter » Nbconvert » Version: 7.16.3

cpe:2.3:a:jupyter:nbconvert:7.16.3
Jupyter » Nbconvert » Version: 7.16.4

cpe:2.3:a:jupyter:nbconvert:7.16.4
Jupyter » Nbconvert » Version: 7.16.5

cpe:2.3:a:jupyter:nbconvert:7.16.5
Jupyter » Nbconvert » Version: 7.16.6

cpe:2.3:a:jupyter:nbconvert:7.16.6
Jupyter » Nbconvert » Version: 7.2.0

cpe:2.3:a:jupyter:nbconvert:7.2.0
Jupyter » Nbconvert » Version: 7.2.1

cpe:2.3:a:jupyter:nbconvert:7.2.1
Jupyter » Nbconvert » Version: 7.2.10

cpe:2.3:a:jupyter:nbconvert:7.2.10
Jupyter » Nbconvert » Version: 7.2.2

cpe:2.3:a:jupyter:nbconvert:7.2.2
Jupyter » Nbconvert » Version: 7.2.3

cpe:2.3:a:jupyter:nbconvert:7.2.3
Jupyter » Nbconvert » Version: 7.2.4

cpe:2.3:a:jupyter:nbconvert:7.2.4
Jupyter » Nbconvert » Version: 7.2.5

cpe:2.3:a:jupyter:nbconvert:7.2.5
Jupyter » Nbconvert » Version: 7.2.6

cpe:2.3:a:jupyter:nbconvert:7.2.6
Jupyter » Nbconvert » Version: 7.2.7

cpe:2.3:a:jupyter:nbconvert:7.2.7
Jupyter » Nbconvert » Version: 7.2.8

cpe:2.3:a:jupyter:nbconvert:7.2.8
Jupyter » Nbconvert » Version: 7.2.9

cpe:2.3:a:jupyter:nbconvert:7.2.9
Jupyter » Nbconvert » Version: 7.3.0

cpe:2.3:a:jupyter:nbconvert:7.3.0
Jupyter » Nbconvert » Version: 7.3.1

cpe:2.3:a:jupyter:nbconvert:7.3.1
Jupyter » Nbconvert » Version: 7.4.0

cpe:2.3:a:jupyter:nbconvert:7.4.0
Jupyter » Nbconvert » Version: 7.5.0

cpe:2.3:a:jupyter:nbconvert:7.5.0
Jupyter » Nbconvert » Version: 7.6.0

cpe:2.3:a:jupyter:nbconvert:7.6.0
Jupyter » Nbconvert » Version: 7.7.0

cpe:2.3:a:jupyter:nbconvert:7.7.0
Jupyter » Nbconvert » Version: 7.7.1

cpe:2.3:a:jupyter:nbconvert:7.7.1
Jupyter » Nbconvert » Version: 7.7.2

cpe:2.3:a:jupyter:nbconvert:7.7.2
Jupyter » Nbconvert » Version: 7.7.3

cpe:2.3:a:jupyter:nbconvert:7.7.3
Jupyter » Nbconvert » Version: 7.7.4

cpe:2.3:a:jupyter:nbconvert:7.7.4
Jupyter » Nbconvert » Version: 7.8.0

cpe:2.3:a:jupyter:nbconvert:7.8.0
Jupyter » Nbconvert » Version: 7.9.0

cpe:2.3:a:jupyter:nbconvert:7.9.0
Jupyter » Nbconvert » Version: 7.9.1

cpe:2.3:a:jupyter:nbconvert:7.9.1
Jupyter » Nbconvert » Version: 7.9.2

cpe:2.3:a:jupyter:nbconvert:7.9.2

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-39377

Products

Pricing

Contact Us