nbconvert, part of the Jupyter ecosystem, allows notebooks to be exported to other formats using Jinja templates. Between versions 5.4.0 and 7.17.2, the ExtractOutputPreprocessor joined a cell‑output metadata filename supplied by the user with the output directory path without restricting the result to the intended directory. A crafted notebook can therefore supply a filename that traverses directories and writes arbitrary files on the filesystem where the conversion process runs. This flaw could allow an attacker to overwrite configuration files, drop malicious payloads, or otherwise modify system state, potentially leading to privilege escalation or host compromise.

The vulnerability exists in Jupyter nbconvert releases from version 5.4.0 through 7.17.2. Any installation of those versions, regardless of operating system, is susceptible. The issue was addressed in release 7.17.2, which includes proper input validation to constrain output paths.

With a CVSS score of 8.8, this is a high‑severity flaw. No EPSS score is published, but the flaw enables a local user who can supply a malicious notebook to trigger an arbitrary file write. In environments where nbconvert runs with elevated privileges or on shared file systems, the potential impact is significant. The vulnerability is not listed in the CISA KEV catalog, yet its severity warrants immediate attention.