CVE-2026-39378: nbconvert has an Arbitrary File Read via Path Traversal in HTMLExporter Image Embedding
## Summary When `HTMLExporter.embed_images=True`, nbconvert's markdown renderer allows arbitrary file read via path traversal in image references. A malicious notebook can exfiltrate sensitive files from the conversion host by embedding them as base64 data URIs in the output HTML. ## Patches Upgrade to nbconvert 7.17.1 ## Workarounds Do not enable `HTMLExporter.embed_images` (it is not enabled by default).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-39378?
CVE-2026-39378 has a high severity level due to the risk of arbitrary file read via path traversal.
How do I fix CVE-2026-39378?
To fix CVE-2026-39378, upgrade to nbconvert version 7.17.1 or later.
Which versions of nbconvert are affected by CVE-2026-39378?
CVE-2026-39378 affects nbconvert versions from 6.5 to 7.17.0.
What is the impact of CVE-2026-39378 on users?
CVE-2026-39378 allows an attacker to read arbitrary files on the system, which can lead to sensitive data exposure.
Is CVE-2026-39378 fixed in the latest release?
Yes, CVE-2026-39378 is fixed in nbconvert version 7.17.1.