CVE-2025-53000

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions of nbconvert up to and including 7.16.6 on Windows have a vulnerability in which converting a notebook containing SVG output to a PDF results in unauthorized code execution. Specifically, a third party can create a `inkscape.bat` file that defines a Windows batch script, capable of arbitrary code execution. When a user runs `jupyter nbconvert --to pdf` on a notebook containing SVG output to a PDF on a Windows platform from this directory, the `inkscape.bat` file is run unexpectedly. This issue has been patched in version 7.17.0.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-427

Affected software

No affected versions have been published.

Timeline

Published: Dec 17, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-530029.8LLaMA-Factory is a tuning library for large language models. A remote code execution vulnerability was discovered in LLaMA-Factory versions CVE-2025-530038.2The Janssen Project is an open-source identity and access management (IAM) platform. Prior to version 1.8.0, the Config API returns results CVE-2025-530049.8DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, there is a bypass vulnerability in D CVE-2025-530059.8DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, there is a bypass vulnerability in D CVE-2025-530069.8DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, in both PostgreSQL and Redshift, apa CVE-2025-530078.9arduino-esp32 provides an Arduino core for the ESP32. Versions prior to 3.3.0-RC1 and 3.2.1 contain a HTTP Response Splitting vulnerability.CVE-2025-530086.5GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk CVE-2025-530097.5MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In versions CVE-2025-53016.1ONLYOFFICE Docs (DocumentServer) in versions equal and below 8.3.1 are affected by a reflected cross-site scripting (XSS) issue when opening CVE-2025-530107.5MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In version 1 CVE-2025-530117.5MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In version 1 CVE-2025-530127.5MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In version 1