CVE-2026-39377

{
  "id": "CVE-2026-39377",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-21T01:16:05.937",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions 6.5 through 7.17.0 allow arbitrary file writes to locations outside the intended output directory when processing notebooks containing crafted cell attachment filenames. The `ExtractAttachmentsPreprocessor` passes attachment filenames directly to the filesystem without sanitization, enabling path traversal attacks. This vulnerability provides complete control over both the destination path and file extension. Version 7.17.1 contains a patch."
    },
    {
      "lang": "es",
      "value": "La herramienta nbconvert, jupyter nbconvert, convierte cuadernos Jupyter a varios otros formatos a través de plantillas Jinja. Las versiones 6.5 hasta la 7.17.0 permiten escrituras de archivos arbitrarias a ubicaciones fuera del directorio de salida previsto al procesar cuadernos que contienen nombres de archivo de adjuntos de celda manipulados. El ’ExtractAttachmentsPreprocessor’ pasa los nombres de archivo de los adjuntos directamente al sistema de archivos sin saneamiento, lo que permite ataques de salto de ruta. Esta vulnerabilidad proporciona control completo tanto sobre la ruta de destino como sobre la extensión del archivo. La versión 7.17.1 contiene un parche."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "jupyter",
          "product": "nbconvert",
          "versions": [
            {
              "version": ">= 6.5, < 7.17.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-21T16:01:22.179013Z",
          "id": "CVE-2026-39377",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        },
        {
          "lang": "en",
          "value": "CWE-73"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:jupyter:nbconvert:*:*:*:*:*:python:*:*",
              "versionStartIncluding": "6.5.0",
              "versionEndExcluding": "7.17.1",
              "matchCriteriaId": "B8ACC92D-6ED7-40BE-917E-5527F6746B60"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/jupyter/nbconvert/releases/tag/v7.17.1",
      "source": "[email protected]",
      "tags": [
        "Product"
      ]
    },
    {
      "url": "https://github.com/jupyter/nbconvert/security/advisories/GHSA-4c99-qj7h-p3vg",
      "source": "[email protected]",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}