Executive Summary

CVE-2026-39378 is a moderate severity vulnerability in the Python package nbconvert, specifically in versions 6.5 through 7.17.0. It occurs when the HTMLExporter component is used with the option `embed_images=True`.

In this mode, nbconvert's markdown renderer improperly handles image references, allowing an attacker to perform arbitrary file reads via path traversal. This means that a malicious Jupyter notebook can include specially crafted image references that cause nbconvert to read files outside the intended directory.

When nbconvert converts the notebook to HTML with image embedding enabled, it reads arbitrary files from the host filesystem and embeds their contents as base64-encoded data URIs in the output HTML, effectively exfiltrating sensitive files from the conversion host.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized disclosure of sensitive files from the host where nbconvert is run.

An attacker can exploit this by providing a malicious Jupyter notebook that, when converted to HTML with image embedding enabled, causes nbconvert to read and embed arbitrary files from the filesystem.

The impact is a high confidentiality breach, as sensitive data can be exfiltrated without requiring any privileges or complex conditions, only user interaction to convert the malicious notebook.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking the version of the nbconvert package installed on your system and whether the HTMLExporter is configured with embed_images=True.

• Run a command to check the nbconvert version, for example: `pip show nbconvert` or `pip list | grep nbconvert`.
• Inspect your nbconvert configuration or scripts to see if the HTMLExporter is used with the option `embed_images=True` enabled.

There are no specific network detection commands provided, but monitoring for conversion of untrusted notebooks with this setting enabled can help identify potential exploitation.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability immediately, upgrade nbconvert to version 7.17.1 or later where the issue is fixed.

Alternatively, ensure that the HTMLExporter option `embed_images` is not enabled, as it is disabled by default.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthorized disclosure of sensitive files from the host system by embedding them into HTML output, which can lead to exfiltration of confidential data.

Such unauthorized data exposure can negatively impact compliance with data protection regulations and standards like GDPR and HIPAA, which require safeguarding sensitive personal and health information against unauthorized access and disclosure.

Therefore, exploitation of this vulnerability could result in violations of these regulations due to the potential leakage of protected data.

Useful 0 Not Useful 0