{"id":"CVE-2026-114140","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-114140","generatedAt":"2026-10-28T02:23:55.122Z","title":"From 5.4.0 until 7.17.2, ExtractOutputPreprocessor in nbconvert/preprocessors/extractoutput.py joins the attacker-controlled cell output metadata filename to output_files_dir without limiting the result to the intended directory.","description":"The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. From 5.4.0 until 7.17.2, ExtractOutputPreprocessor in nbconvert/preprocessors/extractoutput.py joins the attacker-controlled cell output metadata filename to output_files_dir without limiting the result to the intended directory. When a victim converts a malicious notebook with the markdown, LaTeX, reStructuredText, or AsciiDoc exporter, path traversal in the output filename can write attacker-controlled output data to arbitrary locations accessible to the victim. Running the notebook cell again replaces the malicious output metadata, but merely converting the supplied notebook does not. This issue is fixed in version 7.17.2.","published":"2026-10-21T21:17:57.000Z","lastModified":"2026-10-22T17:29:28.000Z","status":"Awaiting Analysis","sourceIdentifier":"security-advisories@github.com","cvss":{"version":"4.0","score":8.8,"severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-22"],"affected":[],"epss":{"score":0.00381,"percentile":0.31874,"date":"2026-10-26","history":[{"date":"2026-10-22","score":0.00313,"percentile":0.22945}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.38%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-21T21:17:57.000Z","detail":{"score":"8.8","severity":"HIGH","publishedAt":"2026-10-21T21:17:56.520Z"},"summary":"New CVE, high severity (CVSS 8.8)."}],"references":[{"url":"https://github.com/jupyter/nbconvert/commit/ce4bd99aec31d81d759fa8eeb8643179392ec66f","source":"security-advisories@github.com"},{"url":"https://github.com/jupyter/nbconvert/releases/tag/v7.17.2","source":"security-advisories@github.com"},{"url":"https://github.com/jupyter/nbconvert/security/advisories/GHSA-pjvx-prjx-h659","source":"security-advisories@github.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-114140","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}