The nbconvert tool in jupyter converts notebooks to other formats using Jinja templates. In affected versions (6.5 to before 7.17.1), enabling HTMLExporter.embed_images causes the markdown renderer to improperly restrict pathnames, allowing path traversal attacks. This enables reading arbitrary files from the host during conversion, which can be exfiltrated as embedded base64 images in the HTML output. The issue is addressed in nbconvert 7.17.1. Disabling the embed_images option prevents exploitation.

An attacker who can supply a malicious notebook and trigger conversion with embed_images enabled can read sensitive files from the conversion host. This leads to confidentiality loss of arbitrary files. There is no impact on integrity or availability. The CVSS score is 6.5 (medium severity), reflecting network attack vector, low complexity, no privileges required, user interaction needed, and high confidentiality impact.

Upgrade to jupyter nbconvert version 7.17.1 or later where the vulnerability is fixed. If upgrading is not immediately possible, do not enable the HTMLExporter.embed_images option, as it is disabled by default and enabling it triggers the vulnerability. No other specific mitigations are indicated.