Jupyter nbconvert: Arbitrary file write via path traversal (CVE-2026-114140)

Jupyter nbconvert contains an arbitrary file write vulnerability (CVE-2026-114140) affecting versions 5.4.0 through 7.17.1. The flaw resides in the ExtractOutputPreprocessor component within extractoutput.py. When exporting notebooks to Markdown, LaTeX, reStructuredText (RST), or AsciiDoc, the application fails to sanitize the filename attribute within cell output metadata. An attacker can use path traversal sequences (e.g., ../) in this metadata to write files outside of the intended output directory.

Impact

An attacker can write files to arbitrary locations on the host system where the nbconvert process is running. This can lead to the overwriting of sensitive configuration files, such as SSH authorized_keys, potentially resulting in full system compromise.

Recommendation

• Upgrade nbconvert to version 7.17.2 or later immediately.
• Review environments where nbconvert is utilized to process untrusted notebook files.
• Apply the principle of least privilege by running conversion processes within isolated containers or restricted service accounts that lack write access to sensitive system directories.