Vulnerability GHSA-4c99-qj7h-p3vg
Advisory details are being prepared in the background.
Medium Risk
MEDIUM RISK
CVSS Score: 6.5
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
6 months ago
April 21, 2026 at 05:18 PM UTC
nbconvert has an Arbitrary File Write via Path Traversal in Cell Attachment Filenames
6.5.0 - 7.0.0rc0 and 7.0.0rc1 and 7.0.0rc2 and 7.0.0rc3 and 7.0.0 - 7.17.0
6.5.0 - 7.0.0rc0 and 7.0.0rc1 and 7.0.0rc2 and 7.0.0rc3 and 7.0.0 - 7.17.0
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
15 days ago
nbconvert: Arbitrary file write through path traversal in cell output filenames when exporting to md, latex, rst and asciidoc
5.4.0 and 5.4.1.dev0 and 5.4.1 - 6.0.0a0 and 6.0.0a1 and 6.0.0a2 and 6.0.0a3 and 6.0.0a4 and 6.0.0a5 and 6.0.0a6 and 6.0.0b7 and 6.0.0rc0 and 6.0.0 - 6.1.0rc0 and 6.1.0 - 6.2.0rc0 and 6.2.0rc1 and 6.2.0rc2 and 6.2.0 - 6.3.0b0 and 6.3.0 - 7.0.0rc0 and 7.0.0rc1 and 7.0.0rc2 and 7.0.0rc3 and 7.0.0 - 7.17.1 GHSA-pjvx-prjx-h659
5.4.0 and 5.4.1.dev0 and 5.4.1 - 6.0.0a0 and 6.0.0a1 and 6.0.0a2 and 6.0.0a3 and 6.0.0a4 and 6.0.0a5 and 6.0.0a6 and 6.0.0b7 and 6.0.0rc0 and 6.0.0 - 6.1.0rc0 and 6.1.0 - 6.2.0rc0 and 6.2.0rc1 and 6.2.0rc2 and 6.2.0 - 6.3.0b0 and 6.3.0 - 7.0.0rc0 and 7.0.0rc1 and 7.0.0rc2 and 7.0.0rc3 and 7.0.0 - 7.17.1 GHSA-pjvx-prjx-h659
Unknown
4 months ago
nbconvert has an uncontrolled search path that leads to unauthorized code execution on Windows
0.0.0 and 4.0.0 - 5.0.0b1 and 5.0.0 - 5.1.1 and 5.2.1 - 5.4.0 and 5.4.1.dev0 and 5.4.1 - 6.0.0a0 and 6.0.0a1 and 6.0.0a2 and 6.0.0a3 and 6.0.0a4 and 6.0.0a5 and 6.0.0a6 and 6.0.0b7 and 6.0.0rc0 and 6.0.0 - 6.1.0rc0 and 6.1.0 - 6.2.0rc0 and 6.2.0rc1 and 6.2.0rc2 and 6.2.0 - 6.3.0b0 and 6.3.0 - 7.0.0rc0 and 7.0.0rc1 and 7.0.0rc2 and 7.0.0rc3 and 7.0.0 - 7.16.6 PYSEC-2026-1691
0.0.0 and 4.0.0 - 5.0.0b1 and 5.0.0 - 5.1.1 and 5.2.1 - 5.4.0 and 5.4.1.dev0 and 5.4.1 - 6.0.0a0 and 6.0.0a1 and 6.0.0a2 and 6.0.0a3 and 6.0.0a4 and 6.0.0a5 and 6.0.0a6 and 6.0.0b7 and 6.0.0rc0 and 6.0.0 - 6.1.0rc0 and 6.1.0 - 6.2.0rc0 and 6.2.0rc1 and 6.2.0rc2 and 6.2.0 - 6.3.0b0 and 6.3.0 - 7.0.0rc0 and 7.0.0rc1 and 7.0.0rc2 and 7.0.0rc3 and 7.0.0 - 7.16.6 PYSEC-2026-1691
Medium Risk
4 months ago
jupyter/nbconvert allows Cross-site Scripting (XSS) via unsanitized `text/vnd.mermaid` output in HTML exports
0.0.0 and 4.0.0 - 5.0.0b1 and 5.0.0 - 5.1.1 and 5.2.1 - 5.4.0 and 5.4.1.dev0 and 5.4.1 - 6.0.0a0 and 6.0.0a1 and 6.0.0a2 and 6.0.0a3 and 6.0.0a4 and 6.0.0a5 and 6.0.0a6 and 6.0.0b7 and 6.0.0rc0 and 6.0.0 - 6.1.0rc0 and 6.1.0 - 6.2.0rc0 and 6.2.0rc1 and 6.2.0rc2 and 6.2.0 - 6.3.0b0 and 6.3.0 - 7.0.0rc0 and 7.0.0rc1 and 7.0.0rc2 and 7.0.0rc3 and 7.0.0 - 7.17.0 GHSA-9754-6rhw-gj3h
0.0.0 and 4.0.0 - 5.0.0b1 and 5.0.0 - 5.1.1 and 5.2.1 - 5.4.0 and 5.4.1.dev0 and 5.4.1 - 6.0.0a0 and 6.0.0a1 and 6.0.0a2 and 6.0.0a3 and 6.0.0a4 and 6.0.0a5 and 6.0.0a6 and 6.0.0b7 and 6.0.0rc0 and 6.0.0 - 6.1.0rc0 and 6.1.0 - 6.2.0rc0 and 6.2.0rc1 and 6.2.0rc2 and 6.2.0 - 6.3.0b0 and 6.3.0 - 7.0.0rc0 and 7.0.0rc1 and 7.0.0rc2 and 7.0.0rc3 and 7.0.0 - 7.17.0 GHSA-9754-6rhw-gj3h
Medium Risk
6 months ago
nbconvert has an Arbitrary File Read via Path Traversal in HTMLExporter Image Embedding
6.5.0 - 7.0.0rc0 and 7.0.0rc1 and 7.0.0rc2 and 7.0.0rc3 and 7.0.0 - 7.17.0 GHSA-7jqv-fw35-gmx9
6.5.0 - 7.0.0rc0 and 7.0.0rc1 and 7.0.0rc2 and 7.0.0rc3 and 7.0.0 - 7.17.0 GHSA-7jqv-fw35-gmx9
Medium Risk
6 months ago
No summary available
6.5.0 - 7.0.0rc0 and 7.0.0rc1 and 7.0.0rc2 and 7.0.0rc3 and 7.0.0 - 7.17.0 PYSEC-2026-2230
6.5.0 - 7.0.0rc0 and 7.0.0rc1 and 7.0.0rc2 and 7.0.0rc3 and 7.0.0 - 7.17.0 PYSEC-2026-2230
Impacted packages
Timeline
Published
6 months ago
April 21, 2026 at 05:18 PM UTC
Fixed (7.17.1)
7 months ago
April 08, 2026 at 12:44 AM UTC
Last Modified
1 month ago
September 10, 2026 at 03:51 AM UTC