Cpe:2.3:a:jupyter:nbconvert:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3ajupyternbconvert/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 22 Oct 2026 20:03:31 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgJupyter nbconvert: Arbitrary file write via path traversal (CVE-2026-114140)https://feed.craftedsignal.io/briefs/2026-10-nbconvert-traversal/Thu, 22 Oct 2026 20:03:31 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-nbconvert-traversal/Jupyter nbconvert versions up to 7.17.1 are vulnerable to an arbitrary file write attack via path traversal in malicious notebook cell metadata, allowing execution of arbitrary file writes when exporting to specific formats.Jupyter nbconvert contains an arbitrary file write vulnerability (CVE-2026-114140) affecting versions 5.4.0 through 7.17.1. The flaw resides in the ExtractOutputPreprocessor component within extractoutput.py. When exporting notebooks to Markdown, LaTeX, reStructuredText (RST), or AsciiDoc, the application fails to sanitize the filename attribute within cell output metadata. An attacker can use path traversal sequences (e.g., ../) in this metadata to write files outside of the intended output directory.

Impact

An attacker can write files to arbitrary locations on the host system where the nbconvert process is running. This can lead to the overwriting of sensitive configuration files, such as SSH authorized_keys, potentially resulting in full system compromise.

Recommendation

  • Upgrade nbconvert to version 7.17.2 or later immediately.
  • Review environments where nbconvert is utilized to process untrusted notebook files.
  • Apply the principle of least privilege by running conversion processes within isolated containers or restricted service accounts that lack write access to sensitive system directories.
]]>highadvisorypath-traversalarbitrary-file-writecve-2026-114140supply-chain