{"id":"ghsa-ghsa-pjvx-prjx-h659","seq":309578,"kind":"advisory","title":"nbconvert: Arbitrary file write through path traversal in cell output filenames when exporting to md, latex, rst and asciidoc","url":"https://github.com/advisories/GHSA-pjvx-prjx-h659","permalink":"https://vulnpulse.app/items/ghsa-ghsa-pjvx-prjx-h659","summary":"影響: pip:nbconvert >= 5.4.0, <= 7.17.1 → 7.17.2\nnbconvert <= v7.17.1 has an arbitrary file write vulnerability due to a path traversal in ipynb cell output metadata, more specifically on the filename attribute. Vulnerable converters : --to markdown, --to latex, --to rst, --to asciidoc. In ExtractOutputPreprocessor, extractoutput.py:116-119 joins attacker-controlled path to output_files_dir with no canonicalization check, enabling arbitrary file write. This is a sibling vulnerability of https://github.com/advisories/GHSA-4c99-qj7h-p3vg. Impac…","severity":"high","techs":["python","github"],"cves":["CVE-2026-114140"],"tags":["GHSA-pjvx-prjx-h659","nbconvert"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-22T16:23:28.000Z","fetched_at":"2026-10-22T20:09:55.169Z"}