CVE-2026-39378: nbconvert has an Arbitrary File Read via Path Traversal in HTMLExporter Image Embedding

April 21, 2026

When HTMLExporter.embed_images=True, nbconvert’s markdown renderer allows arbitrary file read via path traversal in image references. A malicious notebook can exfiltrate sensitive files from the conversion host by embedding them as base64 data URIs in the output HTML.

References

github.com/advisories/GHSA-7jqv-fw35-gmx9
github.com/jupyter/nbconvert/releases/tag/v7.17.1
github.com/jupyter/nbconvert/security/advisories/GHSA-7jqv-fw35-gmx9
nvd.nist.gov/vuln/detail/CVE-2026-39378

Code Behaviors & Features

Detect and mitigate CVE-2026-39378 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →