DEBIAN-CVE-2026-39378

The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. In versions 6.5 through 7.17.0, when HTMLExporter.embedimages=True, nbconvert's markdown renderer allows arbitrary file read via path traversal in image references. A malicious notebook...

CVE-2026-39378

nbconvert (jupyter nbconvert) versions 6.5–7.17.0 are vulnerable when HTMLExporter.embed_images is enabled, because the markdown renderer allows arbitrary file reads via path traversal in image references. A malicious notebook could exfiltrate sensitive host files by embedding them as base64 data...