https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T06:20:37.348152+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-39378 CVE-2026-39378 — nbconvert has an Arbitrary File Read via Path Traversal in HTMLExporter Image Embedding 2026-10-08T06:20:37.349397+00:00

Affected: jupyter nbconvert

The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. In versions 6.5 through 7.17.0, when `HTMLExporter.embed_images=True`, nbconvert's markdown renderer allows arbitrary file read via path traversal in image references. A malicious notebook can exfiltrate sensitive files from the conversion host by embedding them as base64 data URIs in the output HTML. nbconvert 7.17.1 contains a fix. As a workaround, do not enable `HTMLExporter.embed_images`; it is not enabled by default.