{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/nbconvert--7.17.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:jupyter:nbconvert:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-114140"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["nbconvert (\u003c= 7.17.1)"],"_cs_severities":["high"],"_cs_tags":["path-traversal","arbitrary-file-write","cve-2026-114140","supply-chain"],"_cs_type":"advisory","_cs_vendors":["Jupyter"],"content_html":"\u003cp\u003eJupyter nbconvert contains an arbitrary file write vulnerability (CVE-2026-114140) affecting versions 5.4.0 through 7.17.1. The flaw resides in the \u003ccode\u003eExtractOutputPreprocessor\u003c/code\u003e component within \u003ccode\u003eextractoutput.py\u003c/code\u003e. When exporting notebooks to Markdown, LaTeX, reStructuredText (RST), or AsciiDoc, the application fails to sanitize the \u003ccode\u003efilename\u003c/code\u003e attribute within cell output metadata. An attacker can use path traversal sequences (e.g., ../) in this metadata to write files outside of the intended output directory.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eAn attacker can write files to arbitrary locations on the host system where the nbconvert process is running. This can lead to the overwriting of sensitive configuration files, such as SSH \u003ccode\u003eauthorized_keys\u003c/code\u003e, potentially resulting in full system compromise.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade nbconvert to version 7.17.2 or later immediately.\u003c/li\u003e\n\u003cli\u003eReview environments where nbconvert is utilized to process untrusted notebook files.\u003c/li\u003e\n\u003cli\u003eApply the principle of least privilege by running conversion processes within isolated containers or restricted service accounts that lack write access to sensitive system directories.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-22T20:03:31Z","date_published":"2026-10-22T20:03:31Z","id":"https://feed.craftedsignal.io/briefs/2026-10-nbconvert-traversal/","summary":"Jupyter nbconvert versions up to 7.17.1 are vulnerable to an arbitrary file write attack via path traversal in malicious notebook cell metadata, allowing execution of arbitrary file writes when exporting to specific formats.","title":"Jupyter nbconvert: Arbitrary file write via path traversal (CVE-2026-114140)","url":"https://feed.craftedsignal.io/briefs/2026-10-nbconvert-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Nbconvert (\u003c= 7.17.1)","version":"https://jsonfeed.org/version/1.1"}