Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2025-53000

25
FAUCET Score

CVE-2025-53000 is a critical vulnerability affecting jupyter nbconvert versions up to 7.16.6 on Windows. It allows for unauthorized code execution when converting a notebook with SVG output to PDF, due to an unexpected execution of a malicious inkscape.bat file. This vulnerability carries a CVSS score of 7.8 (HIGH), indicating a local attack vector with low complexity, requiring user interaction, and leading to high impact on confidentiality, integrity, and availability. While no active exploitation, public exploit code, or significant community discussion has been observed, the FAUCET Risk Score of 90/100 highlights its potential severity.

Impacted Technologies

VendorProductVersion(s)CPE
<= 7.16.6CPE matchmatch criteria
cpe:2.3:a:jupyter:nbconvert:*:*:*:*:*:python:*:*

CVSS Data

CVSS version used by this source: 4.0

8.5HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector
LOCAL
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
PASSIVE
VS Confidentiality
HIGH
VS Integrity
HIGH
VS Availability
HIGH
SS Confidentiality
NONE
SS Integrity
NONE
SS Availability
NONE
Exploit Maturity
NOT_DEFINED
CvssVersion
4.0

Exploit Intelligence

EPSS Score
0.24%
Probability of exploitation in next 30 days
EPSS Percentile
15.0%
Percentile rank of EPSS score among Peer Group
As of 2026-07-28
Model: v2026.06.15
This CVE's current EPSS score of 0.0024 is in the 14th percentile among its peer group of 11,621 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (1)

pippatch availablevia ghsa
Product: nbconvertFixed in: 7.17.0

Vendor Advisories (2)

pipGHSA-xm59-rqc7-hhvfhigh

nbconvert has an uncontrolled search path that leads to unauthorized code execution on Windows

Dec 18, 2025
redhatCVE-2025-53000Important

nbconvert: nbconvert: Arbitrary code execution via malicious SVG to PDF conversion on Windows

Dec 17, 2025

References

github.com / jupyter/nbconvert/blob/4f61702f5c7524d8a3c4ac0d5fc33a6ac2fa36a7/nbconvert/preprocessors/svg2pdf.py
github.com / jupyter/nbconvert/commit/c9ac1d1040459ed1ff9eb34e9918ce5a87cf9d71
github.com / jupyter/nbconvert/issues/2258
github.com / jupyter/nbconvert/releases/tag/v7.17.0
github.com / jupyter/nbconvert/security/advisories/GHSA-xm59-rqc7-hhvf
imperva.com / blog/code-execution-in-jupyter-notebook-exports
ExploitThird Party Advisory