PT-2025-39657 · Unknown+2 · Jupyterlab+2

CVE-2025-59842 · Published 2025-09-26 · Updated 2026-07-07

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions jupyterlab versions prior to 4.4.8

Description jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Links generated with LaTeX typesetters in Markdown files and Markdown cells in JupyterLab and Jupyter Notebook did not include the noopener attribute. This could potentially lead to reverse tabnabbing attacks if links generated by third-party LaTeX-rendering extensions included target= blank. Reverse tabnabbing is a type of phishing attack where a malicious website replaces the content of a legitimate website in a new tab or window. The official LaTeX typesetter extensions for JupyterLab do not include target= blank, so there is no impact for JupyterLab users with default installations.

Recommendations Update to jupyterlab version 4.4.8 or later.

Exploit

Fix

Weakness Enumeration

CWE-1022

Related Identifiers

BIT-JUPYTERLAB-2025-59842

CVE-2025-59842

GHSA-VVFJ-2JQX-52JM

OPENSUSE-SU-2025:15591-1

PYSEC-2026-1482

Affected Products

Alt Linux

Debian

Jupyterlab

References · 22

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59842.json · Exploit
• https://github.com/jupyterlab/jupyterlab/commit/88ef373039a8cc09f27d3814382a512d9033675c · Patch
• https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-vvfj-2jqx-52jm · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-59842 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-59842 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-59842 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15591-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-59842 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-1482 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-jupyterlab-2025-59842 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-59842 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-59842 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vvfj-2jqx-52jm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-59842 · Vendor Advisory
• https://github.com/jupyterlab/jupyterlab · Note