CVE-2026-39378: nbconvert has an Arbitrary File Read via Path Traversal in HTMLExporter Image Embedding

When HTMLExporter.embed_images=True, nbconvert’s markdown renderer allows arbitrary file read via path traversal in image references. A malicious notebook can exfiltrate sensitive files from the conversion host by embedding them as base64 data URIs in the output HTML.