CVE-2026-39378

{
  "id": "CVE-2026-39378",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-21T01:16:06.073",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. In versions 6.5 through 7.17.0, when `HTMLExporter.embed_images=True`, nbconvert's markdown renderer allows arbitrary file read via path traversal in image references. A malicious notebook can exfiltrate sensitive files from the conversion host by embedding them as base64 data URIs in the output HTML. nbconvert 7.17.1 contains a fix. As a workaround, do not enable `HTMLExporter.embed_images`; it is not enabled by default."
    },
    {
      "lang": "es",
      "value": "La herramienta nbconvert, jupyter nbconvert, convierte cuadernos Jupyter a varios otros formatos a través de plantillas Jinja. En las versiones 6.5 a 7.17.0, cuando HTMLExporter.embed_images=True, el renderizador markdown de nbconvert permite la lectura arbitraria de archivos a través de salto de ruta en referencias de imagen. Un cuaderno malicioso puede exfiltrar archivos sensibles del host de conversión incrustándolos como URIs de datos base64 en el HTML de salida. nbconvert 7.17.1 contiene una corrección. Como solución alternativa, no habilite HTMLExporter.embed_images; no está habilitado por defecto."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "jupyter",
          "product": "nbconvert",
          "versions": [
            {
              "version": ">= 6.5, < 7.17.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-21T13:43:09.070985Z",
          "id": "CVE-2026-39378",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        },
        {
          "lang": "en",
          "value": "CWE-73"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:jupyter:nbconvert:*:*:*:*:*:python:*:*",
              "versionStartIncluding": "6.5.0",
              "versionEndExcluding": "7.17.1",
              "matchCriteriaId": "B8ACC92D-6ED7-40BE-917E-5527F6746B60"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/jupyter/nbconvert/releases/tag/v7.17.1",
      "source": "[email protected]",
      "tags": [
        "Product"
      ]
    },
    {
      "url": "https://github.com/jupyter/nbconvert/security/advisories/GHSA-7jqv-fw35-gmx9",
      "source": "[email protected]",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}