Threats affecting pkg:pypi/nbconvert

A path traversal vulnerability (CWE-22) exists in the ExtractOutputPreprocessor component of jupyter nbconvert versions 5.4.0 up to but not including 7.17.2. This vulnerability allows an attacker to craft a malicious notebook that, when converted using certain exporters, can write output files to arbitrary locations accessible by the victim. The issue is fixed in version 7.17.2.

A path traversal vulnerability exists in jupyter nbconvert versions 6.5 through 7.17.0 when the HTMLExporter.embed_images option is enabled. This flaw allows a malicious notebook to read arbitrary files from the host system by embedding them as base64 data URIs in the output HTML. The vulnerability is fixed in version 7.17.1. By default, HTMLExporter.

A path traversal vulnerability exists in jupyter nbconvert versions 6.5 through 7.17.0. The vulnerability arises from the ExtractAttachmentsPreprocessor component, which does not sanitize attachment filenames, allowing crafted filenames to write files outside the intended output directory. This enables an attacker to control the destination path and file extension of arbitrary files written to the filesystem. Version 7.17.1 includes a patch addressing this issue. The vulnerability has a medium severity with a CVSS score of 6.

The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions of nbconvert up to and including 7.16.6 on Windows have a vulnerability in which converting a notebook containing SVG output to a PDF results in unauthorized code execution. Specifically, a third party can create a `inkscape.bat` file that defines a Windows batch script, capable of arbitrary code execution. When a user runs `jupyter nbconvert --to pdf` on a notebook containing SVG output to a PDF on a Windows platform from this directory, the `inkscape.bat` file is run unexpectedly. This issue has been patched in version 7.17.0.