Read the docs
TI-2026-78983 Aliases CVE-2026-114140GHSA-pjvx-prjx-h659

Path traversal in nbconvert lets crafted notebooks write files

Priority HIGH 73CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Active
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

The nbconvert tool from 5.4.0 before 7.17.2 joins an attacker-controlled cell output filename to the output directory without limiting the result to that directory (CWE-22). When a victim converts a malicious notebook with the markdown, LaTeX, reStructuredText, or AsciiDoc exporter, a remote attacker can write output data to arbitrary locations the victim can access. The victim must convert the supplied notebook for this to happen.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. From 5.4.0 until 7.17.2, ExtractOutputPreprocessor in nbconvert/preprocessors/extractoutput.py joins the attacker-controlled cell output metadata filename to output_files_dir without limiting the result to the intended directory. When a victim converts a malicious notebook with the markdown, LaTeX, reStructuredText, or AsciiDoc exporter, path traversal in the output filename can write attacker-controlled output data to arbitrary locations accessible to the victim. Running the notebook cell again replaces the malicious output metadata, but merely converting the supplied notebook does not. This issue is fixed in version 7.17.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00455 39th percentileScored 2026-11-07
Fix Partial nbconvert (jupyter): 7.17.2nbconvert (PyPI): 7.17.2Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
jupyterlabnbconvert5.4.0 to before 7.17.27.17.2Patch availableCNA
—nbconvert (PyPI)5.4.0 to before 7.17.27.17.2Patch availableGHSA-pjvx-prjx-h659
  • nbconvert Vendorjupyterlab Affected 5.4.0 to before 7.17.2 Fixed in 7.17.2 Patch available CNA
  • nbconvert (PyPI) Vendor— Affected 5.4.0 to before 7.17.2 Fixed in 7.17.2 Patch available GHSA-pjvx-prjx-h659

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:jupyter:nbconvert:*:*:*:*:*:*:*:*——jupyterlab
  • cpe:2.3:a:jupyter:nbconvert:*:*:*:*:*:*:*:* Versions — — ·jupyterlab

Remediation

Upgrade the PyPI nbconvert package to version 7.17.2, which fixes this issue. Red Hat rates this Important and lists Red Hat OpenShift AI (RHOAI) as affected with no fix plan available.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

  • Fix · CNA nbconvert (jupyter) Fixed in 7.17.2
  • Fix · GHSA-pjvx-prjx-h659 nbconvert (PyPI) Fixed in 7.17.2 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Not affected: 1 product
  • Red Hat OpenShift AI (RHOAI)

Timeline

  1. 2026-10-21 Threatist record created from CVE-2026-114140
  2. 2026-10-22 Affected versions changed · Red Hat
  3. 2026-10-22 CVSS score added · Red Hat
  4. 2026-10-22 Alias added: GHSA-pjvx-prjx-h659
  5. 2026-10-22 Fix available: PyPI/[email protected] · GHSA-pjvx-prjx-h659
  6. 2026-10-22 CVSS score added · GHSA-pjvx-prjx-h659
  7. 2026-10-22 Weakness changed · GHSA-pjvx-prjx-h659
  8. 2026-10-22 5 new references · GHSA-pjvx-prjx-h659
  9. 2026-10-23 Affected versions changed · Red Hat
  10. 2026-10-23 Priority changed: MEDIUM → LOW
  11. 2026-10-30 CISA SSVC decision points changed
  12. 2026-10-30 Priority changed: LOW → HIGH

References

Advisory 1

Other 4

  • TI-2026-32161 Jupyter Enterprise Gateway Has Kubernetes Manifest Injection via Jinja2 Template Rendering CVSS 4.0CRITICAL 10.0
  • TI-2026-32160 Jupyter Enterprise Gateway: Jinja2 Template Server Side Template Injection results in Remote Code Execution CVSS 4.0CRITICAL 10.0
  • TI-2026-32159 Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_prohibited_ids can be Bypassed CVSS 3.1CRITICAL 9.8
  • TI-2024-26623 Remote Code Execution (RCE) vulnerability in jupyterlab extension template `update-integration-tests` GitHub Action CVSS 3.1CRITICAL 10.0
  • TI-2026-39372 JupyterLab Git: Stored XSS leading to RCE CVSS 4.0CRITICAL 9.3
  • TI-2025-33005 nbconvert has an uncontrolled search path that leads to unauthorized code execution on Windows CVSS 4.0HIGH 8.5
See all 89 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences