[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
nbconvert	7.17.1 → 7.17.2

---

nbconvert: Arbitrary file write through path traversal in cell output filenames when exporting to md, latex, rst and asciidoc

CVE-2026-114140 / GHSA-pjvx-prjx-h659

More information

Details

Summary

nbconvert <= v7.17.1 has an arbitrary file write vulnerability due to a path traversal in ipynb cell output metadata, more specifically on the filename attribute.

Vulnerable converters : --to markdown, --to latex, --to rst, --to asciidoc.

In ExtractOutputPreprocessor, extractoutput.py:116-119 joins attacker-controlled path to output_files_dir with no canonicalization check, enabling arbitrary file write.

This is a sibling vulnerability of GHSA-4c99-qj7h-p3vg.

Impact

If a victim runs nbconvert on a malicious ipynb file, it can create some files with arbitrary data in arbitrary locations, i.e. override authorized_keys.

Note that running the cell with jupyter overrides the output, so it would "clean up" malicious cells.

PoC

In a ipynb file:

"cells": [{
        "cell_type": "code", "id": "abc123", "execution_count": 1,
        "metadata": {}, "source": "# PoC",
        "outputs": [{
            "output_type": "display_data",
            "metadata": {
                "filename": "../../../tmp/PWNED.png"  # ← traverses outside output_dir
            },
            "data": {
                # minimal valid PNG (1×1 pixel)
                "image/png": "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg=="
            }
        }]
    }]

Patches

Fixed in

• jupyter/nbconvert@ce4bd99
• 7.17.2

Severity

• CVSS Score: 8.8 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

• https://github.com/jupyter/nbconvert/security/advisories/GHSA-pjvx-prjx-h659
• https://nvd.nist.gov/vuln/detail/CVE-2026-114140
• https://github.com/jupyter/nbconvert/commit/ce4bd99aec31d81d759fa8eeb8643179392ec66f
• https://github.com/jupyter/nbconvert/releases/tag/v7.17.2
• https://github.com/advisories/GHSA-pjvx-prjx-h659

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Configuration

📅 Schedule: (in timezone America/Chicago)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.