CVE catalog

CVE-2025-53000

nbconvert: CVE-2025-53000

Severity: High · CVSS 7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published: Dec 17, 2025, 8:27:59 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.26% · Oct 25, 2026

The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions of nbconvert up to and including 7.16.6 on Windows have a vulnerability in which converting a notebook containing SVG output to a PDF results in unauthorized code execution. Specifically, a third party can create a `inkscape.bat` file that defines a Windows batch script, capable of arbitrary code execution. When a user runs `jupyter nbconvert --to pdf` on a notebook containing SVG output to a PDF on a Windows platform from this directory, the `inkscape.bat` file is run unexpectedly. This issue has been patched in version 7.17.0.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	nbconvert	sid	`7.17.1-2`	not affected
Debian	nbconvert	forky	`7.17.1-2`	not affected
Debian	nbconvert	trixie	`7.16.6-1+deb13u1`	not affected
Debian	nbconvert	bookworm	`6.5.3-3`	not affected
PyPI	nbconvert	Not reported	`7.17.0`	fixed
PyPI	nbconvert	Not reported	`7.17.0`	fixed
Opensuse	python-nbconvert	tumbleweed	`7.17.1-1.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	nbconvert	source	sid	`Not affected`	unimportant	Not reported	Not reported
Debian	nbconvert	source	forky	`Not affected`	unimportant	Not reported	Not reported
Debian	nbconvert	source	trixie	`Not affected`	unimportant	Not reported	Not reported
Debian	nbconvert	source	bookworm	`Not affected`	unimportant	Not reported	Not reported
PyPI	nbconvert	PyPI	Not reported	`7.17.0`	Not reported	GHSA-XM59-RQC7-HHVF	Not reported
PyPI	nbconvert	PyPI	Not reported	`7.17.0`	Not reported	PYSEC-2026-1691	Not reported
Opensuse	python-nbconvert	rpm	tumbleweed	`7.17.1-1.1`	Not reported	OPENSUSE-SU-2026:10603-1	Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

[jupyter-nbconvert]Unknown
Source package: [python-nbconvert]
Details (1)
- 7.17.1-1.4 · noarch · tumbleweed
  Unknown · Fixed: 7.17.1-1.1
  Version impact unknown
  dsa · python-nbconvert · opensuse · tumbleweed
[jupyter-nbconvert-latex]Unknown
Source package: [python-nbconvert]
Details (1)
- 7.17.1-1.4 · noarch · tumbleweed
  Unknown · Fixed: 7.17.1-1.1
  Version impact unknown
  dsa · python-nbconvert · opensuse · tumbleweed
[python313-nbconvert]Unknown
Source package: [python-nbconvert]
Details (1)
- 7.17.1-1.4 · noarch · tumbleweed
  Unknown · Fixed: 7.17.1-1.1
  Version impact unknown
  dsa · python-nbconvert · opensuse · tumbleweed
[python314-nbconvert]Unknown
Source package: [python-nbconvert]
Details (1)
- 7.17.1-1.4 · noarch · tumbleweed
  Unknown · Fixed: 7.17.1-1.1
  Version impact unknown
  dsa · python-nbconvert · opensuse · tumbleweed

[Debian 12 (Bookworm)]

[jupyter-nbconvert]Not affected
Source package: [nbconvert]
Details (2)
- 6.5.3-3 · all · bookworm
  Not affected
  dsa · nbconvert · debian · bookworm
- 6.5.3-3 · all · bookworm
  Not affected
  dsa · nbconvert · debian · bookworm
[python3-nbconvert]Not affected
Source package: [nbconvert]
Details (2)
- 6.5.3-3 · all · bookworm
  Not affected
  dsa · nbconvert · debian · bookworm
- 6.5.3-3 · all · bookworm
  Not affected
  dsa · nbconvert · debian · bookworm
[python-nbconvert-doc]Not affected
Source package: [nbconvert]
Details (2)
- 6.5.3-3 · all · bookworm
  Not affected
  dsa · nbconvert · debian · bookworm
- 6.5.3-3 · all · bookworm
  Not affected
  dsa · nbconvert · debian · bookworm

Observed: Oct 24, 2026, 8:00:23 AM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]