Source: jupyterlab X-Debbugs-CC: [email protected] Severity: important Tags: security
Hi, The following vulnerability was published for jupyterlab. CVE-2025-59842[0]: | jupyterlab is an extensible environment for interactive and | reproducible computing, based on the Jupyter Notebook Architecture. | Prior to version 4.4.8, links generated with LaTeX typesetters in | Markdown files and Markdown cells in JupyterLab and Jupyter Notebook | did not include the noopener attribute. This is deemed to have no | impact on the default installations. Theoretically users of third- | party LaTeX-rendering extensions could find themselves vulnerable to | reverse tabnabbing attacks if links generated by those extensions | included target=_blank (no such extensions are known at time of | writing) and they were to click on a link generated in LaTeX | (typically visibly different from other links). This issue has been | patched in version 4.4.8. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-vvfj-2jqx-52jm https://github.com/jupyterlab/jupyterlab/commit/88ef373039a8cc09f27d3814382a512d9033675c If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2025-59842 https://www.cve.org/CVERecord?id=CVE-2025-59842 Please adjust the affected versions in the BTS as needed.
