StackRadar

CVE-2026-39377

Medium

Advisory

Published 21 Apr 2026In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
6.5
base score, highest
EPSS
0.003
19th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
5
of 17,781 indexed, latest versions
Container images
5
deployed by those charts
Fix available
1 of 1
affected package

nbconvert has an Arbitrary File Write via Path Traversal in Cell Attachment Filenames

Carried by container images the latest versions of 5 of 17,781 indexed charts deploy, on 5 images.

Affected packageAffected versionsFixed inImages
nbconvertpypi7.2.7, 7.7.3, 7.14.1, 7.16.47.17.15
OSV records
GHSA-4c99-qj7h-p3vg
Also known as
PYSEC-2026-2229

Charts affected

5 by stars
ChartLatestAffected imagesRadar Score
daskdask2024.1.11 of 2See more

dask dask 2024.1.1

1 of the 2 container images this version deploys carry CVE-2026-39377.

Container imageDigestPackageFixed in
ghcr.io/dask/dask-notebook:2024.1.0f53bde3acd4f
nbconvert@7.14.1
7.17.1

Open the chart page →

12,746
daskhubdask2024.1.11 of 9See more

daskhub dask 2024.1.1

1 of the 9 container images this version deploys carry CVE-2026-39377.

Container imageDigestPackageFixed in
pangeo/base-notebook:2024.01.155fbe688a4f80
nbconvert@7.14.1
7.17.1

Open the chart page →

14,094
jupyterhubd4nVerified publisher3.3.71 of 7See more

jupyterhub d4n 3.3.7

1 of the 7 container images this version deploys carry CVE-2026-39377.

Container imageDigestPackageFixed in
aristidetm/basic-notebook:3.6.5469dbc951224
nbconvert@7.16.4
7.17.1

Open the chart page →

16,604
jupyterhubkubeblocksVerified publisher0.1.01 of 7See more

jupyterhub kubeblocks 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-39377.

Container imageDigestPackageFixed in
jupyterhub/k8s-singleuser-sample:3.0.1-0.dev.git.6287.hbfb05cd68e4778efec8e
nbconvert@7.7.3
7.17.1

Open the chart page →

7,356
kyso-nbdimekyso1.0.01 of 1See more

kyso-nbdime kyso 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-39377.

Container imageDigestPackageFixed in
kyso/kyso-nbdime:latest4aa9d38ee81d
nbconvert@7.2.7
7.17.1

Open the chart page →

2,765

Container images carrying it

5 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
aristidetm/basic-notebook:3.6.5469dbc951224
nbconvert@7.16.4
7.17.1
1
jupyterhub/k8s-singleuser-sample:3.0.1-0.dev.git.6287.hbfb05cd68e4778efec8e
nbconvert@7.7.3
7.17.1
1
kyso/kyso-nbdime:latest4aa9d38ee81d
nbconvert@7.2.7
7.17.1
1
pangeo/base-notebook:2024.01.155fbe688a4f80
nbconvert@7.14.1
7.17.1
1
ghcr.io/dask/dask-notebook:2024.1.0f53bde3acd4f
nbconvert@7.14.1
7.17.1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.