https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 21:41:39 +0000 https://cve.radiocsirt.org/vuln/brew-jupyterlab-cve-2026-39378 <p><strong>Affected:</strong> Homebrew: jupyterlab</p> <p>## Summary</p> <p>When `HTMLExporter.embed_images=True`, nbconvert&#39;s markdown renderer allows arbitrary file read via path traversal in image references. A malicious notebook can exfiltrate sensitive files from the conversion host by embedding them as base64 data URIs in the output HTML.</p> <p>## Patches</p> <p>Upgrade to nbconvert 7.17.1</p> <p>## Workarounds</p> <p>Do not enable `HTMLExporter.embed_images` (it is not enabled by default).</p> <p><strong>Affected:</strong> Homebrew: jupyterlab</p> <p>## Summary</p> <p>When `HTMLExporter.embed_images=True`, nbconvert&#39;s markdown renderer allows arbitrary file read via path traversal in image references. A malicious notebook can exfiltrate sensitive files from the conversion host by embedding them as base64 data URIs in the output HTML.</p> <p>## Patches</p> <p>Upgrade to nbconvert 7.17.1</p> <p>## Workarounds</p> <p>Do not enable `HTMLExporter.embed_images` (it is not enabled by default).</p> https://cve.radiocsirt.org/vuln/brew-jupyterlab-cve-2026-39378 https://cve.radiocsirt.org/vuln/cve-2026-39378 <p><strong>Affected:</strong> jupyter nbconvert</p> <p>The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. In versions 6.5 through 7.17.0, when `HTMLExporter.embed_images=True`, nbconvert&#39;s markdown renderer allows arbitrary file read via path traversal in image references. A malicious notebook can exfiltrate sensitive files from the conversion host by embedding them as base64 data URIs in the output HTML. nbconvert 7.17.1 contains a fix. As a workaround, do not enable `HTMLExporter.embed_images`; it is not enabled by default.</p> <p><strong>Affected:</strong> jupyter nbconvert</p> <p>The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. In versions 6.5 through 7.17.0, when `HTMLExporter.embed_images=True`, nbconvert&#39;s markdown renderer allows arbitrary file read via path traversal in image references. A malicious notebook can exfiltrate sensitive files from the conversion host by embedding them as base64 data URIs in the output HTML. nbconvert 7.17.1 contains a fix. As a workaround, do not enable `HTMLExporter.embed_images`; it is not enabled by default.</p> https://cve.radiocsirt.org/vuln/cve-2026-39378 https://cve.radiocsirt.org/vuln/ghsa-7jqv-fw35-gmx9 <p><strong>Affected:</strong> PyPI: nbconvert</p> <p>## Summary</p> <p>When `HTMLExporter.embed_images=True`, nbconvert&#39;s markdown renderer allows arbitrary file read via path traversal in image references. A malicious notebook can exfiltrate sensitive files from the conversion host by embedding them as base64 data URIs in the output HTML.</p> <p>## Patches</p> <p>Upgrade to nbconvert 7.17.1</p> <p>## Workarounds</p> <p>Do not enable `HTMLExporter.embed_images` (it is not enabled by default).</p> <p><strong>Affected:</strong> PyPI: nbconvert</p> <p>## Summary</p> <p>When `HTMLExporter.embed_images=True`, nbconvert&#39;s markdown renderer allows arbitrary file read via path traversal in image references. A malicious notebook can exfiltrate sensitive files from the conversion host by embedding them as base64 data URIs in the output HTML.</p> <p>## Patches</p> <p>Upgrade to nbconvert 7.17.1</p> <p>## Workarounds</p> <p>Do not enable `HTMLExporter.embed_images` (it is not enabled by default).</p> https://cve.radiocsirt.org/vuln/ghsa-7jqv-fw35-gmx9