CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-39378

The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. In versions 6.5 through 7.17.0, when `HTMLExporter.embed_images=True`, nbconvert's markdown renderer allows arbitrary file read via path traversal in image references. A malicious notebook can exfiltrate sensitive files from the conversion host by embedding them as base64 data URIs in the output HTML. nbconvert 7.17.1 contains a fix. As a workaround, do not enable `HTMLExporter.embed_images`; it is not enabled by default.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.0

EPSS Ranking 11.4%

CVSS Severity

CVSS v3 Score 6.5

References

Products affected by CVE-2026-39378

Jupyter » Nbconvert » Version: 6.5.0

cpe:2.3:a:jupyter:nbconvert:6.5.0
Jupyter » Nbconvert » Version: 6.5.1

cpe:2.3:a:jupyter:nbconvert:6.5.1
Jupyter » Nbconvert » Version: 6.5.2

cpe:2.3:a:jupyter:nbconvert:6.5.2
Jupyter » Nbconvert » Version: 6.5.3

cpe:2.3:a:jupyter:nbconvert:6.5.3
Jupyter » Nbconvert » Version: 7.0.0

cpe:2.3:a:jupyter:nbconvert:7.0.0
Jupyter » Nbconvert » Version: 7.1.0

cpe:2.3:a:jupyter:nbconvert:7.1.0
Jupyter » Nbconvert » Version: 7.10.0

cpe:2.3:a:jupyter:nbconvert:7.10.0
Jupyter » Nbconvert » Version: 7.11.0

cpe:2.3:a:jupyter:nbconvert:7.11.0
Jupyter » Nbconvert » Version: 7.12.0

cpe:2.3:a:jupyter:nbconvert:7.12.0
Jupyter » Nbconvert » Version: 7.13.0

cpe:2.3:a:jupyter:nbconvert:7.13.0
Jupyter » Nbconvert » Version: 7.13.1

cpe:2.3:a:jupyter:nbconvert:7.13.1
Jupyter » Nbconvert » Version: 7.14.0

cpe:2.3:a:jupyter:nbconvert:7.14.0
Jupyter » Nbconvert » Version: 7.14.1

cpe:2.3:a:jupyter:nbconvert:7.14.1
Jupyter » Nbconvert » Version: 7.14.2

cpe:2.3:a:jupyter:nbconvert:7.14.2
Jupyter » Nbconvert » Version: 7.15.0

cpe:2.3:a:jupyter:nbconvert:7.15.0
Jupyter » Nbconvert » Version: 7.16.0

cpe:2.3:a:jupyter:nbconvert:7.16.0
Jupyter » Nbconvert » Version: 7.16.1

cpe:2.3:a:jupyter:nbconvert:7.16.1
Jupyter » Nbconvert » Version: 7.16.2

cpe:2.3:a:jupyter:nbconvert:7.16.2
Jupyter » Nbconvert » Version: 7.16.3

cpe:2.3:a:jupyter:nbconvert:7.16.3
Jupyter » Nbconvert » Version: 7.16.4

cpe:2.3:a:jupyter:nbconvert:7.16.4
Jupyter » Nbconvert » Version: 7.16.5

cpe:2.3:a:jupyter:nbconvert:7.16.5
Jupyter » Nbconvert » Version: 7.16.6

cpe:2.3:a:jupyter:nbconvert:7.16.6
Jupyter » Nbconvert » Version: 7.2.0

cpe:2.3:a:jupyter:nbconvert:7.2.0
Jupyter » Nbconvert » Version: 7.2.1

cpe:2.3:a:jupyter:nbconvert:7.2.1
Jupyter » Nbconvert » Version: 7.2.10

cpe:2.3:a:jupyter:nbconvert:7.2.10
Jupyter » Nbconvert » Version: 7.2.2

cpe:2.3:a:jupyter:nbconvert:7.2.2
Jupyter » Nbconvert » Version: 7.2.3

cpe:2.3:a:jupyter:nbconvert:7.2.3
Jupyter » Nbconvert » Version: 7.2.4

cpe:2.3:a:jupyter:nbconvert:7.2.4
Jupyter » Nbconvert » Version: 7.2.5

cpe:2.3:a:jupyter:nbconvert:7.2.5
Jupyter » Nbconvert » Version: 7.2.6

cpe:2.3:a:jupyter:nbconvert:7.2.6
Jupyter » Nbconvert » Version: 7.2.7

cpe:2.3:a:jupyter:nbconvert:7.2.7
Jupyter » Nbconvert » Version: 7.2.8

cpe:2.3:a:jupyter:nbconvert:7.2.8
Jupyter » Nbconvert » Version: 7.2.9

cpe:2.3:a:jupyter:nbconvert:7.2.9
Jupyter » Nbconvert » Version: 7.3.0

cpe:2.3:a:jupyter:nbconvert:7.3.0
Jupyter » Nbconvert » Version: 7.3.1

cpe:2.3:a:jupyter:nbconvert:7.3.1
Jupyter » Nbconvert » Version: 7.4.0

cpe:2.3:a:jupyter:nbconvert:7.4.0
Jupyter » Nbconvert » Version: 7.5.0

cpe:2.3:a:jupyter:nbconvert:7.5.0
Jupyter » Nbconvert » Version: 7.6.0

cpe:2.3:a:jupyter:nbconvert:7.6.0
Jupyter » Nbconvert » Version: 7.7.0

cpe:2.3:a:jupyter:nbconvert:7.7.0
Jupyter » Nbconvert » Version: 7.7.1

cpe:2.3:a:jupyter:nbconvert:7.7.1
Jupyter » Nbconvert » Version: 7.7.2

cpe:2.3:a:jupyter:nbconvert:7.7.2
Jupyter » Nbconvert » Version: 7.7.3

cpe:2.3:a:jupyter:nbconvert:7.7.3
Jupyter » Nbconvert » Version: 7.7.4

cpe:2.3:a:jupyter:nbconvert:7.7.4
Jupyter » Nbconvert » Version: 7.8.0

cpe:2.3:a:jupyter:nbconvert:7.8.0
Jupyter » Nbconvert » Version: 7.9.0

cpe:2.3:a:jupyter:nbconvert:7.9.0
Jupyter » Nbconvert » Version: 7.9.1

cpe:2.3:a:jupyter:nbconvert:7.9.1
Jupyter » Nbconvert » Version: 7.9.2

cpe:2.3:a:jupyter:nbconvert:7.9.2

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-39378

Products

Pricing

Contact Us