-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| nbconvert | pip | <= 7.16.6 |
Miggo AIRoot Cause AnalysisThe vulnerability is an uncontrolled search path issue (CWE-427) in the nbconvert library on Windows. The nbconvert.preprocessors.svg2pdf.SVG2PDFPreprocessor._inkscape_default function uses shutil.which("inkscape") to find the inkscape executable. On Windows, this function searches the current working directory first. An attacker can place a malicious script named inkscape.bat in the same directory as a Jupyter notebook. When a user converts this notebook to PDF, nbconvert will execute the malicious script. The execution is triggered by functions that need to run inkscape, such as convert_figure (for the actual conversion) and _inkscape_version_default (to check the version). Both of these functions rely on the path resolved by the vulnerable _inkscape_default function, leading to arbitrary code execution.
SVG2PDFPreprocessor._inkscape_defaultnbconvert/preprocessors/svg2pdf.py
SVG2PDFPreprocessor.convert_figurenbconvert/preprocessors/svg2pdf.py
SVG2PDFPreprocessor._inkscape_version_defaultnbconvert/preprocessors/svg2pdf.py