https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T21:42:15.631295+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/brew-jupyterlab-cve-2026-39378 BREW-jupyterlab-CVE-2026-39378 — nbconvert has an Arbitrary File Read via Path Traversal in HTMLExporter Image Embedding 2026-10-07T21:42:15.633539+00:00

Affected: Homebrew: jupyterlab

## Summary

When `HTMLExporter.embed_images=True`, nbconvert's markdown renderer allows arbitrary file read via path traversal in image references. A malicious notebook can exfiltrate sensitive files from the conversion host by embedding them as base64 data URIs in the output HTML.

## Patches

Upgrade to nbconvert 7.17.1

## Workarounds

Do not enable `HTMLExporter.embed_images` (it is not enabled by default).

 https://cve.radiocsirt.org/vuln/cve-2026-39378 CVE-2026-39378 — nbconvert has an Arbitrary File Read via Path Traversal in HTMLExporter Image Embedding 2026-10-07T21:42:15.633601+00:00

Affected: jupyter nbconvert

The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. In versions 6.5 through 7.17.0, when `HTMLExporter.embed_images=True`, nbconvert's markdown renderer allows arbitrary file read via path traversal in image references. A malicious notebook can exfiltrate sensitive files from the conversion host by embedding them as base64 data URIs in the output HTML. nbconvert 7.17.1 contains a fix. As a workaround, do not enable `HTMLExporter.embed_images`; it is not enabled by default.

 https://cve.radiocsirt.org/vuln/ghsa-7jqv-fw35-gmx9 GHSA-7jqv-fw35-gmx9 — nbconvert has an Arbitrary File Read via Path Traversal in HTMLExporter Image Embedding 2026-10-07T21:42:15.633633+00:00

Affected: PyPI: nbconvert

## Summary

When `HTMLExporter.embed_images=True`, nbconvert's markdown renderer allows arbitrary file read via path traversal in image references. A malicious notebook can exfiltrate sensitive files from the conversion host by embedding them as base64 data URIs in the output HTML.

## Patches

Upgrade to nbconvert 7.17.1

## Workarounds

Do not enable `HTMLExporter.embed_images` (it is not enabled by default).