CVE-2026-114140

A flaw was found in nbconvert. This flaw allows an attacker to perform an arbitrary file write by enticing a user to convert a maliciously crafted Jupyter notebook. Due to improper path validation in ExtractOutputPreprocessor, attacker-controlled cell output metadata can traverse outside the targ...

CVE-2026-114140

The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. From 5.4.0 until 7.17.2, ExtractOutputPreprocessor in nbconvert/preprocessors/extractoutput.py joins the attacker-controlled cell output metadata filename to outputfilesdir without...

CVE-2026-114140

The nbconvert tool (jupyter nbconvert) versions 5.4.0 through 7.17.2 contains a path traversal vulnerability in the ExtractOutputPreprocessor component located at nbconvert/preprocessors/extractoutput.py. The flaw exists because the tool joins attacker-controlled cell output metadata filenames wi...

EUVD-2026-107551

The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. From 5.4.0 until 7.17.2, ExtractOutputPreprocessor in nbconvert/preprocessors/extractoutput.py joins the attacker-controlled cell output metadata filename to outputfilesdir without...

CVE-2026-114140 nbconvert: File write via path traversal in cell output filenames

The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. From 5.4.0 until 7.17.2, ExtractOutputPreprocessor in nbconvert/preprocessors/extractoutput.py joins the attacker-controlled cell output metadata filename to outputfilesdir without...