Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

nbconvert

6 known vulnerabilities (3 high, 3 medium), with the versions each affects and the releases that fix them.

Latest release
7.17.2 (Oct 12, 2026): no advisory affects it
Newest unaffected release
7.17.2 (Oct 12, 2026), the latest release
Advisories
6 · 3 high, 3 medium
Weekly downloads
14.2M
Dependents
6,151
Releases
104 since 4.0.0 (Jul 12, 2015)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 6

  • nbconvert: File write via path traversal in cell output filenames

    Affected: from 5.4.0, fixed in 7.17.2.

    Fixed in 7.17.2 (released Oct 12, 2026, 9 days before disclosure).

    The latest release, 7.17.2, is not affected.

  • CVE-2026-6658Medium 5.4

    Cross-site Scripting (XSS) in jupyter/nbconvert

    Affected: through 7.17.0.

    Fixed in 7.17.1 (released Apr 8, 2026, 79 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 7.17.2, is not affected.

  • CVE-2026-39378Medium 6.5

    nbconvert has an Arbitrary File Read via Path Traversal in HTMLExporter Image Embedding

    Affected: from 6.5.0, fixed in 7.17.1.

    Fixed in 7.17.1 (released Apr 8, 2026, 13 days before disclosure).

    The latest release, 7.17.2, is not affected.

  • CVE-2026-39377Medium 6.5

    nbconvert has an Arbitrary File Write via Path Traversal in Cell Attachment Filenames

    Affected: from 6.5.0, fixed in 7.17.1.

    Fixed in 7.17.1 (released Apr 8, 2026, 13 days before disclosure).

    The latest release, 7.17.2, is not affected.

  • nbconvert has an uncontrolled search path that leads to unauthorized code execution on Windows

    Affected: fixed in 7.17.0.

    Fixed in 7.17.0 (released Jan 29, 2026, 43 days after disclosure).

    The latest release, 7.17.2, is not affected.

  • nbconvert vulnerable to cross-site scripting (XSS) via multiple exploit paths

    Affected: fixed in 6.3.0a0; fixed in 6.5.1.

    Fixed in 6.5.1 (released Aug 9, 2022, 9 days before disclosure).

    The latest release, 7.17.2, is not affected.