Skip to content
OpenAdvisories

Package · Ubuntu

nbconvert

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.4
    CVE-2026-6658

    Cross-site Scripting (XSS) in jupyter/nbconvert

    A vulnerability in jupyter/nbconvert versions <= 7.17.0 allows for Cross-site Scripting (XSS) via unsanitized `text/vnd.mermaid` output in HTML exports. The `data_mermaid` block in `share/templates/lab/base.html.j2` renders `text/vnd.mermaid` cell output dire…

    jupyter jupyter/jupyter nbconvert nbconvert Debian Ubuntu PyPI
  • Medium 6.5
    CVE-2026-39378

    nbconvert has an Arbitrary File Read via Path Traversal in HTMLExporter Image Embedding

    The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. In versions 6.5 through 7.17.0, when `HTMLExporter.embed_images=True`, nbconvert's markdown renderer allows arbitrary file read via path traversal …

    jupyter nbconvert nbconvert nbconvert Debian Ubuntu PyPI
  • Medium 6.5
    CVE-2026-39377

    nbconvert has an Arbitrary File Write via Path Traversal in Cell Attachment Filenames

    The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions 6.5 through 7.17.0 allow arbitrary file writes to locations outside the intended output directory when processing notebooks containing cra…

    jupyter nbconvert nbconvert nbconvert Debian Ubuntu PyPI