CVE-2025-53000: nbconvert Uncontrolled Search Path Leading to Unauthorized Code Execution on Windows
Summary
CVE-2025-53000: nbconvert has an uncontrolled search path that leads to unauthorized code execution on Windows. Affects nbconvert versions < 7.16.6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
nbconvert is a widely used tool in the Jupyter ecosystem that allows users to convert Jupyter notebooks into various formats, including PDF. It is particularly valued for its ability to facilitate the sharing and presentation of data analyses and visualizations. However, a significant vulnerability has been identified in nbconvert that affects Windows users, specifically related to how it handles SVG output during PDF conversion.
Vulnerability Detail
The vulnerability arises from an uncontrolled search path when nbconvert attempts to locate the 'inkscape' executable during the conversion process. On Windows, if a user runs the command 'jupyter nbconvert --to pdf' on a notebook containing SVG output from a directory that includes a malicious 'inkscape.bat' file, this file can be executed unexpectedly. This leads to unauthorized code execution, allowing an attacker to run arbitrary commands on the user's system. The root cause is linked to the way Windows handles DLL loading, where it searches the current directory and the directory from which the program was loaded, potentially exposing users to malicious scripts.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid executing the nbconvert command in directories where they do not control the contents. Additionally, ensure that no malicious 'inkscape.bat' files are present in the working directory before running the conversion command.
Conclusion
The CVE-2025-53000 vulnerability in nbconvert poses a significant risk to Windows users by allowing unauthorized code execution through an uncontrolled search path. It is crucial for users to update to the latest version of nbconvert to protect against this vulnerability and to be cautious about the directories from which they run conversion commands.
See every vulnerability recorded for nbconvert →
FAQ
The CVSS score of this vulnerability is 8.5, indicating a high severity level.
All Windows users of nbconvert versions up to 7.16.6 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
'inkscape.bat' is a Windows batch script that can execute arbitrary commands, potentially leading to unauthorized actions on the user's system.
Yes, you can mitigate the issue by avoiding running nbconvert in directories that may contain untrusted files.
Related vulnerabilities
Recent vulnerabilities recorded for nbconvert.
