Nbconvert CVE-2026-39378

The HTMLExporter.embed_images option must be explicitly enabled in the nbconvert configuration. This is a non-default setting; the feature is disabled by default. A malicious or compromised Jupyter notebook must be provided to the conversion process. The notebook conversion process must be initiated by a user or automated system with read access to sensitive files on the host system. The attacker does not require authentication to nbconvert itself, and the attack succeeds against any version 6.5-7.17.0 when the above conditions are met. Exploitation is limited to confidentiality breach; the attacker cannot modify files or disrupt availability. The attack requires the attacker to craft a valid .ipynb notebook file and deliver it to a target system where conversion occurs.

CVSS 6.5 with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N indicates a network-reachable attack requiring no privileges but with user interaction (notebook must be converted by the target), resulting in high confidentiality impact but no integrity or availability damage. The requirement for user interaction (UI:R) - someone must actively trigger notebook conversion - is a significant limiting factor that reduces real-world risk compared to the base CVSS score. However, in automated processing pipelines (e.g., JupyterHub with auto-conversion, CI/CD workflows converting notebooks), this interaction requirement may be automatically satisfied. The attack is unauthenticated (PR:N) and of low complexity (AC:L), making exploitation straightforward for any attacker who can deliver a malicious notebook. No EPSS score or KEV status was provided in the input data; absent these signals, exploitation probability cannot be quantified beyond CVSS assessment. The workaround (disabling HTMLExporter.embed_images by default) is already in place in default configurations, meaning only users who explicitly enable the feature face risk. This is a legitimate high-impact vulnerability for affected configurations, but the real-world attack surface is narrower than the CVSS score suggests due to the required user interaction and non-default feature enablement.

An attacker crafts a malicious Jupyter notebook (.ipynb) containing image references with path traversal sequences (e.g., ). The notebook is shared with or uploaded to a system where a user runs nbconvert with HTMLExporter.embed_images enabled to convert it to HTML. During conversion, nbconvert processes the malicious image reference, resolves the traversal path, reads the sensitive file (/etc/passwd in this example), encodes it as base64, and embeds it as a data URI in the output HTML. The attacker can exfiltrate the HTML file or view the embedded content to obtain the sensitive data.