CVE-2026-39377

OVERVIEW CVE-2026-39377 is a path traversal vulnerability in Jupyter nbconvert versions 6.5 through 7.17.0 that allows arbitrary file writes outside the intended output directory. The vulnerability exists in the ExtractAttachmentsPreprocessor component, which fails to sanitize attachment filenames from Jupyter notebooks before writing them to the filesystem. An attacker can craft malicious notebooks with specially formatted cell attachment filenames to write files to arbitrary locations with controlled extensions. SEVERITY The vulnerability carries a CVSS v3.1 score of 6.5 (MEDIUM) with a network-based attack vector requiring no special privileges but dependent on user interaction. Attack complexity is low, meaning an attacker simply needs to deliver a malicious notebook for processing. The primary impact is integrity compromise, as attackers gain complete control over file destination paths and extensions, potentially enabling code execution through strategic file placement. Confidentiality and availability are not directly affected. EXPLOITATION STATUS There are no confirmed reports of active exploitation, and this vulnerability does not appear on CISA's Known Exploited Vulnerabilities (KEV) catalog. The EPSS score of 0.0004 indicates minimal real-world exploitation likelihood relative to other vulnerabilities. No public exploit code has achieved notable community attention, suggesting limited awareness or weaponization. Users should prioritize patching to version 7.17.1 or later as a precautionary measure, particularly if processing notebooks from untrusted sources.