PT-2025-39657 · Unknown · Jupyterlab

Published 2025-09-26 · Updated 2025-09-26 · CVE-2025-59842

Positive Technologies · (AI Summary)

CVSS v4.0

2.1

2.1

Low

Base vector

AV:N/AC:H/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

**Name of the Vulnerable Software and Affected Versions**

jupyterlab versions prior to 4.4.8

**Description**

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Links generated with LaTeX typesetters in Markdown files and Markdown cells in JupyterLab and Jupyter Notebook did not include the `noopener` attribute. This could potentially lead to reverse tabnabbing attacks if links generated by third-party LaTeX-rendering extensions included `target= blank`. Reverse tabnabbing is a type of phishing attack where a malicious website replaces the content of a legitimate website in a new tab or window. The official LaTeX typesetter extensions for JupyterLab do not include `target= blank`, so there is no impact for JupyterLab users with default installations.

**Recommendations**

Update to jupyterlab version 4.4.8 or later.

Fix

Weakness Enumeration

CWE-1022

Related Identifiers

CVE-2025-59842

GHSA-VVFJ-2JQX-52JM

Affected Products

Jupyterlab

References · 8

• https://osv.dev/vulnerability/CVE-2025-59842 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vvfj-2jqx-52jm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59842 · Security Note
• https://github.com/jupyterlab/jupyterlab/commit/88ef373039a8cc09f27d3814382a512d9033675c · Note
• https://github.com/jupyterlab/jupyterlab · Note
• https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-vvfj-2jqx-52jm · Note
• https://twitter.com/VulmonFeeds/status/1971704141559832700 · Twitter Post
• https://twitter.com/CVEnew/status/1971610369433997618 · Twitter Post