Hi,

The following vulnerability was published for nbconvert.

CVE-2026-114140[0]:
| The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to
| various other formats via Jinja templates. From 5.4.0 until 7.17.2,
| ExtractOutputPreprocessor in
| nbconvert/preprocessors/extractoutput.py joins the attacker-
| controlled cell output metadata filename to output_files_dir without
| limiting the result to the intended directory. When a victim
| converts a malicious notebook with the markdown, LaTeX,
| reStructuredText, or AsciiDoc exporter, path traversal in the output
| filename can write attacker-controlled output data to arbitrary
| locations accessible to the victim. Running the notebook cell again
| replaces the malicious output metadata, but merely converting the
| supplied notebook does not. This issue is fixed in version 7.17.2.

https://github.com/jupyter/nbconvert/security/advisories/GHSA-pjvx-prjx-h659
Fixed by: https://github.com/jupyter/nbconvert/commit/ce4bd99aec31d81d759fa8eeb8643179392ec66f (v7.17.2)


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-114140
https://www.cve.org/CVERecord?id=CVE-2026-114140

Please adjust the affected versions in the BTS as needed.