CVE-2026-114140
published 2026-10-21CVE-2026-114140: The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. From 5.4.0 until 7.17.2…
PriorityP348high8.8CVSS 4.0
AVNACLATPPRLUIAVCHVIHVAHSCHSIHSAHEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.38%
31.8th percentile
The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. From 5.4.0 until 7.17.2, ExtractOutputPreprocessor in nbconvert/preprocessors/extractoutput.py joins the attacker-controlled cell output metadata filename to output_files_dir without limiting the result to the intended directory. When a victim converts a malicious notebook with the markdown, LaTeX, reStructuredText, or AsciiDoc exporter, path traversal in the output filename can write attacker-controlled output data to arbitrary locations accessible to the victim. Running the notebook cell again replaces the malicious output metadata, but merely converting the supplied notebook does not. This issue is fixed in version 7.17.2.
Affected
27 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jupyter | nbconvert | — | — |
| jupyter | nbconvert | >= 5.4.0 < 7.17.2 | 7.17.2 |
| rhoai | odh-feature-server-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-datascience-cpu-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-minimal-cpu-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-pytorch-cuda-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-pytorch-rocm-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-tensorflow-cuda-py312-rhel9 | — | — |
| rhoai | odh-pipeline-runtime-tensorflow-rocm-py312-rhel9 | — | — |
| rhoai | odh-th-torch-cpu-py312-rhel9 | — | — |
| rhoai | odh-th-torch-cuda-py312-rhel9 | — | — |
| rhoai | odh-th-torch-rocm-py312-rhel9 | — | — |
| rhoai | odh-th06-cpu-torch210-py312-rhel9 | — | — |
| rhoai | odh-th06-cuda130-torch210-py312-rhel9 | — | — |
| rhoai | odh-th06-rocm64-torch291-py312-rhel9 | — | — |
| rhoai | odh-workbench-codeserver-datascience-cpu-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-datascience-cpu-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-minimal-cpu-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-minimal-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-minimal-rocm-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-pytorch-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-pytorch-rocm-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-tensorflow-cuda-py312-rhel9 | — | — |
CVSS provenance
nvdv4.08.8HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
nbconvert: Arbitrary file write through path traversal in cell output filenames when exporting to md, latex, rst and asciidoc
ghsa·2026-10-22
CVE-2026-114140 [HIGH] CWE-22 nbconvert: Arbitrary file write through path traversal in cell output filenames when exporting to md, latex, rst and asciidoc
nbconvert: Arbitrary file write through path traversal in cell output filenames when exporting to md, latex, rst and asciidoc
### Summary
nbconvert <= v7.17.1 has an arbitrary file write vulnerability due to a path traversal in ipynb cell output metadata, more specifically on the filename attribute.
Vulnerable converters : `--to markdown`, `--to latex`, `--to rst`, `--to asciidoc`.
In `ExtractOutputPreprocessor`, `extractoutput.py:116-119` joins attacker-controlled `path` to `output_files_dir` with no canonicalization check, enabling arbitrary file write.
This is a sibling vulnerability of https://github.com/advisories/GHSA-4c99-qj7h-p3vg.
### Impact
If a victim runs nbconvert on a malicious ipynb file, it can create some files with arbitrary data in arbitrary locations, i.e. overri
VulDB
Jupyter nbconvert up to 7.17.1 ExtractOutputPreprocessor extractoutput.py path traversal
vuldb·2026-10-21·CVSS 8.8
CVE-2026-114140 [HIGH] Jupyter nbconvert up to 7.17.1 ExtractOutputPreprocessor extractoutput.py path traversal
A vulnerability was found in Jupyter nbconvert up to 7.17.1. It has been rated as critical. The affected element is an unknown function of the file nbconvert/preprocessors/extractoutput.py of the component ExtractOutputPreprocessor. The manipulation leads to path traversal.
This vulnerability is documented as CVE-2026-114140. The attack can be initiated remotely. There is not any exploit available.
Upgrading the affected component is advised.
Red Hat
nbconvert: nbconvert: arbitrary file write via path traversal in ExtractOutputPreprocessor
vendor_redhat·2026-10-21·CVSS 8.8
CVE-2026-114140 [HIGH] CWE-22 nbconvert: nbconvert: arbitrary file write via path traversal in ExtractOutputPreprocessor
nbconvert: nbconvert: arbitrary file write via path traversal in ExtractOutputPreprocessor
The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. From 5.4.0 until 7.17.2, ExtractOutputPreprocessor in nbconvert/preprocessors/extractoutput.py joins the attacker-controlled cell output metadata filename to output_files_dir without limiting the result to the intended directory. When a victim converts a malicious notebook with the markdown, LaTeX, reStructuredText, or AsciiDoc exporter, path traversal in the output filename can write attacker-controlled output data to arbitrary locations accessible to the victim. Running the notebook cell again replaces the malicious output metadata, but merely converting the supplied notebook does not. T
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-10-21
Published