# What changed in nbconvert

> 4 changes in nbconvert 7 from its official release notes, upgrade guides and advisories: 4 security. Each one cited. Sources checked 2026-10-24. HTML: https://unstale.sh/pypi/nbconvert/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## nbconvert 7

### Security

- nbconvert: Arbitrary file write through path traversal in cell output filenames when exporting to md, latex, rst and asciidoc (7.17.2) — [security advisory](https://github.com/advisories/GHSA-PJVX-PRJX-H659)
- nbconvert has an Arbitrary File Read via Path Traversal in HTMLExporter Image Embedding (7.17.1) — [security advisory](https://github.com/advisories/GHSA-7JQV-FW35-GMX9)
- nbconvert has an Arbitrary File Write via Path Traversal in Cell Attachment Filenames (7.17.1) — [security advisory](https://github.com/advisories/GHSA-4C99-QJ7H-P3VG)
- nbconvert has an uncontrolled search path that leads to unauthorized code execution on Windows (7.17.0) — [security advisory](https://github.com/advisories/GHSA-XM59-RQC7-HHVF)