CVE-2026-114140

HighCVSS 8.8/10Last modified Oct 30, 2026

Description

The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. From 5.4.0 until 7.17.2, ExtractOutputPreprocessor in nbconvert/preprocessors/extractoutput.py joins the attacker-controlled cell output metadata filename to output_files_dir without limiting the result to the intended directory. When a victim converts a malicious notebook with the markdown, LaTeX, reStructuredText, or AsciiDoc exporter, path traversal in the output filename can write attacker-controlled output data to arbitrary locations accessible to the victim. Running the notebook cell again replaces the malicious output metadata, but merely converting the supplied notebook does not. This issue is fixed in version 7.17.2.

Metrics

CVSS 4.0 8.8/10

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-22

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
jupyter	nbconvert	>= 5.4.0, < 7.17.2

References

Timeline

Published: Oct 21, 2026
Last modified: Oct 30, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1141418.7toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, the toml.parse() compiler's addTableArray() function in lib/compiler CVE-2026-1141428.8toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() can write attacker-controlled properties to Object.prot CVE-2026-1141438.7toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() repeatedly slices and rejoins every path prefix in lib/CVE-2026-1141447.5toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() passes unbounded hexadecimal, octal, binary, and decima CVE-2026-1141457.5GitPython is a python library used to interact with Git repositories. Prior to 3.2.1, create_submodule() in git/objects/submodule/base.py ac CVE-2026-1141469.0Incorrect authorization in ASP.NET Core allows an authorized attacker to elevate privileges over a network.CVE-2026-1141477.5Missing release of memory after effective lifetime in ASP.NET Core allows an unauthorized attacker to deny service over a network.CVE-2026-1141487.8Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.CVE-2026-1141497.5Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.CVE-2026-1141505.9Use of uninitialized resource in ASP.NET Core allows an unauthorized attacker to disclose information over a network.CVE-2026-1141518.8Deserialization of untrusted data in Visual Studio allows an unauthorized attacker to execute code over a network.CVE-2026-1141528.8Stack-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.