Nbconvert CVE-2026-39377

The ExtractAttachmentsPreprocessor must be active and processing the notebook (enabled by default in most nbconvert workflows). The notebook must contain cell attachments with path traversal sequences in filenames. The user or automated process must invoke nbconvert with notebook processing (e.g., nbconvert --to html notebook.ipynb or programmatic conversion via nbconvert.exporters). The process must have write permissions to the target traversal paths for exploitation to succeed. Non-default configurations that disable attachment extraction or that sanitize filenames prevent exploitation. No special user privileges or authentication are required; any user with read access to a malicious notebook can trigger file writes.

CVSS 6.5 (Medium) with network attack vector reflects the requirement for user interaction (UI:R) to open a crafted notebook, which moderates what would otherwise be a critical vulnerability. The AV:N/AC:L/PR:N parameters indicate no authentication or special complexity is required once a notebook is opened. EPSS and KEV status not provided in input data, limiting probability assessment. The real-world risk is significant for environments where users handle untrusted notebooks (shared datasets, collaborative work, downloaded examples), but lower for air-gapped or strictly controlled environments. The availability of GitHub advisory and patched version (7.17.1) suggests vendor response is timely. Path traversal with arbitrary file write capability could enable persistent compromise if .pyc files, importable modules, or application entry points are targeted. Compared against CVSS base score: the integrity impact (I:H) combined with no direct authentication barrier creates substantial risk for shared Jupyter deployments and educational institutions where notebook sharing is common.

An attacker distributes a malicious Jupyter notebook via GitHub, a dataset repository, or direct email. The notebook contains a cell with an embedded attachment whose filename is crafted as '../../../tmp/evil.py' or '../../../../etc/cron.d/backdoor'. When a user opens the notebook and nbconvert extracts attachments (during preview, export, or automated processing), the ExtractAttachmentsPreprocessor writes the malicious file to the traversed path outside the intended output directory, potentially overwriting system files or injecting code into executable paths.