Jupyter nbconvert path traversal allows arbitrary file writes

Jupyter nbconvert contains a path traversal vulnerability that allows attackers to write files to arbitrary locations on a system. This flaw exists in versions 5.4.0 through 7.17.1 and is fixed in version 7.17.2.

What happened

The National Vulnerability Database records CVE-2026-114140 as a high-severity issue with a CVSS score of 8.8. The flaw resides in the ExtractOutputPreprocessor component found within the nbconvert/preprocessors/extractoutput.py file. This component processes cell output metadata during the conversion of Jupyter notebooks into other formats.

When processing a notebook, the tool joins an attacker-controlled filename from the cell output metadata with the designated output directory. The code fails to restrict the resulting path to the intended directory. This allows path traversal sequences in the filename to escape the target folder.

An attacker can exploit this by creating a malicious notebook containing specific metadata. When a victim converts this notebook using the markdown, LaTeX, reStructuredText, or AsciiDoc exporter, the tool writes the attacker-controlled data to an arbitrary location. The location must be accessible to the user running the conversion process.

Simply converting the supplied notebook is sufficient to trigger the file write. Running the notebook cell again is not required for the initial exploitation. However, running the cell again replaces the malicious output metadata. This distinction is important for understanding the persistence of the attack vector.

Why it matters

This vulnerability affects a wide range of Jupyter nbconvert versions, spanning from 5.4.0 to 7.17.1. Many organizations use Jupyter notebooks for data analysis and machine learning workflows. These environments often run with elevated privileges or access to sensitive data directories.

The ability to write arbitrary files can lead to further compromise. Attackers might overwrite configuration files or place scripts in executable directories. This could facilitate privilege escalation or persistent access to the affected system. The high CVSS score reflects the ease of exploitation and the potential impact on system integrity.

What to watch

• Monitor for unexpected file creation or modification in directories outside the standard notebook output folders.
• Check logs for conversion jobs that process notebooks with unusual or complex metadata fields.
• Look for access to sensitive paths during the execution of nbconvert commands by untrusted users.

Signals worth monitoring

Security teams should examine file system logs for write operations occurring during notebook conversion tasks. Look for paths that traverse up directory levels using sequences like dot-dot-slash. Alert on any file creation in system or configuration directories triggered by user-level processes. Check for anomalies in the metadata of notebooks being processed, especially if they originate from untrusted sources. Verify that output files are confined to expected directories. Investigate any successful writes to locations that do not match the standard export behavior.

Background: CVSS score

CVSS provides a standardized vector for exploit difficulty and access requirements, not business value. A high score indicates an easy attack path, not necessarily significant damage. You must contextualize the score with your environment’s exposure, asset value, and compensating controls to determine true risk.

Read the full guide: CVSS Scores: Why High Numbers Mislead Your Risk Assessment

What to do and how to stay safe: Jupyter

• Upgrade Jupyter nbconvert to version 7.17.2 or later to apply the vendor-provided fix.
• Audit existing notebooks for malicious metadata or unexpected file write operations before conversion.
• Restrict the execution of nbconvert to trusted environments and users with minimal necessary privileges.
• Implement file integrity monitoring to detect unauthorized changes to critical system files.

General security guidance from the Firewall Chronicle newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Jupyter nbconvert are affected by this vulnerability?

Versions from 5.4.0 up to, but not including, 7.17.2 are affected by this path traversal flaw.

What is the severity rating of CVE-2026-114140?

The National Vulnerability Database rates this vulnerability as HIGH with a CVSS score of 8.8.

How can an attacker exploit this vulnerability?

Attackers can create a malicious notebook with specific metadata that, when converted, writes files to arbitrary accessible locations.