Vulnerabilities for nbconvert

First version without a known vulnerability: 7.17.1

Details

• GHSA-7jqv-fw35-gmx92026-04-21

  nbconvert has an Arbitrary File Read via Path Traversal in HTMLExporter Image Embedding

  Fixed in: 7.17.1

• GHSA-4c99-qj7h-p3vg2026-04-21

  nbconvert has an Arbitrary File Write via Path Traversal in Cell Attachment Filenames

  Fixed in: 7.17.1

• GHSA-xm59-rqc7-hhvf2025-12-18

  nbconvert has an uncontrolled search path that leads to unauthorized code execution on Windows

  Fixed in: 7.17.0

• GHSA-9jmq-rx5f-8jwq2022-08-10

  nbconvert vulnerable to cross-site scripting (XSS) via multiple exploit paths

  Fixed in: 6.5.1, 6.3.0a0