Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
5 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
nbconvert <= v7.17.1 has an arbitrary file write vulnerability due to a path traversal in ipynb cell output metadata, more specifically on the filename attribute. Vulnerable converters : --to markdown, --to latex, --to rst, --to asciidoc. In ExtractOutputPreprocessor, extractoutput.py:116-119 joins attacker-controlled path to outputfilesdir with no canonicalization check, enabling arbitrary file write. This is a sibling vulnerability of https://github.com/advisories/GHSA-4c99-qj7h-p3vg. Impact If a victim runs nbconvert on a malicious ipynb file, it can create some files with arbitrary data in arbitrary locations, i.e. override authorizedkeys. Note that running the cell with jupyter overrides the output, so it would "clean up" malicious cells. PoC In a ipynb file: Patches Fixed in - https://github.com/jupyter/nbconvert/commit/ce4bd99aec31d81d759fa8eeb8643179392ec66f - 7.17.2
Recommended action: Upgrade to 7.17.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When HTMLExporter.embedimages=True, nbconvert's markdown renderer allows arbitrary file read via path traversal in image references. A malicious notebook can exfiltrate sensitive files from the conversion host by embedding them as base64 data URIs in the output HTML. Patches Upgrade to nbconvert 7.17.1 Workarounds Do not enable HTMLExporter.embedimages (it is not enabled by default).
Recommended action: Upgrade to 7.17.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Arbitrary File Write via Path Traversal in Cell Attachment Filenames Summary nbconvert allows arbitrary file writes to locations outside the intended output directory when processing notebooks containing crafted cell attachment filenames. The ExtractAttachmentsPreprocessor passes attachment filenames directly to the filesystem without sanitization, enabling path traversal attacks. This vulnerability provides complete control over both the destination path and file extension. Impact This vulnerability allows writing files with arbitrary content to arbitrary filesystem locations, limited only by the permissions of the process running nbconvert. The attacker controls: - Full destination path (via ../ traversal) - Filename - File extension - File content Patches - upgrade to nbconvert v7.17.1 Workarounds disable ExtractAttachmentsPreprocessor by setting:
Recommended action: Upgrade to 7.17.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
On Windows, converting a notebook containing SVG output to a PDF results in unauthorized code execution. Specifically, a third party can create a inkscape.bat file that defines a Windows batch script, capable of arbitrary code execution. When a user runs jupyter nbconvert --to pdf on a notebook containing SVG output to a PDF on a Windows platform from this directory, the inkscape.bat file is run unexpectedly. Details Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer. nbconvert searches for an inkscape executable when converting notebooks to PDFs here: https://github.com/jupyter/nbconvert/blob/4f61702f5c7524d8a3c4ac0d5fc33a6ac2fa36a7/nbconvert/preprocessors/svg2pdf.py#L104 The MITRE page on CWE-427 (Uncontrolled Search Path Element) summarizes the root cause succinctly: In Windows-based systems, when the LoadLibrary or LoadLibraryEx function is called with a DLL name that does not contain a fully qualified path,…
Recommended action: Upgrade to 7.17.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Most of the fixes will be in this repo, though, so having it here gives us the private fork to work on patches Below is currently a duplicate of the original report: ---- Received on security@ipython.org unedited, I'm not sure if we want to make it separate advisories. Pasted raw for now, feel free to edit or make separate advisories if you have the rights to. I think the most important is to switch back from nbviewer.jupyter.org -> nbviewer.org at the cloudflare level I guess ? There might be fastly involved as well. --- Impact _What kind of vulnerability is it? Who is impacted?_ Patches _Has the problem been patched? What versions should users upgrade to?_ Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_ References _Are there any links users can visit to find out more?_ For more information If you have any questions or comments about this advisory: * Open an issue in example link to repo *…
Recommended action: Upgrade to 6.5.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.