CVE-2025-59842
published 2025-09-26CVE-2025-59842: jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to version 4.4.8, links…
PriorityP419medium4.3CVSS 3.1
AVNACLPRNUIRSUCLINAN
EPSS
0.22%
12.9th percentile
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to version 4.4.8, links generated with LaTeX typesetters in Markdown files and Markdown cells in JupyterLab and Jupyter Notebook did not include the noopener attribute. This is deemed to have no impact on the default installations. Theoretically users of third-party LaTeX-rendering extensions could find themselves vulnerable to reverse tabnabbing attacks if links generated by those extensions included target=_blank (no such extensions are known at time of writing) and they were to click on a link generated in LaTeX (typically visibly different from other links). This issue has been patched in version 4.4.8.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | jupyterlab | — | — |
| jupyter | jupyterlab | < 4.4.8 | 4.4.8 |
| jupyterlab | jupyterlab | < 4.4.8 | 4.4.8 |
| jupyterlab | jupyterlab | >= 0 < 4.4.8 | 4.4.8 |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
nvdv4.02.1LOWCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv2.1LOW
vendor_debian2.1LOW
vendor_redhat2.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
JupyterLab LaTeX typesetter links did not enforce `noopener` attribute
osv·2025-09-26
CVE-2025-59842 [LOW] JupyterLab LaTeX typesetter links did not enforce `noopener` attribute
JupyterLab LaTeX typesetter links did not enforce `noopener` attribute
Links generated with LaTeX typesetters in Markdown files and Markdown cells in JupyterLab and Jupyter Notebook did not include the `noopener` attribute.
This is deemed to have no impact on the default installations. Theoretically users of third-party LaTeX-rendering extensions could find themselves vulnerable to reverse tabnabbing attacks if:
- links generated by those extensions included `target=_blank` (no such extensions are known at time of writing) and
- they were to click on a link generated in LaTeX (typically visibly different from other links).
For consistency with handling on other links, new versions of JupyterLab will enforce `noopener` and `target=_blank` on all links generated by typesetters. The former
OSV
CVE-2025-59842: jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture
osv·2025-09-26·CVSS 2.1
CVE-2025-59842 [LOW] CVE-2025-59842: jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to version 4.4.8, links generated with LaTeX typesetters in Markdown files and Markdown cells in JupyterLab and Jupyter Notebook did not include the noopener attribute. This is deemed to have no impact on the default installations. Theoretically users of third-party LaTeX-rendering extensions could find themselves vulnerable to reverse tabnabbing attacks if links generated by those extensions included target=_blank (no such extensions are known at time of writing) and they were to click on a link generated in LaTeX (typically visibly different from other links). This issue has been patched in version 4.4.8.
GHSA
JupyterLab LaTeX typesetter links did not enforce `noopener` attribute
ghsa·2025-09-26
CVE-2025-59842 [LOW] CWE-1022 JupyterLab LaTeX typesetter links did not enforce `noopener` attribute
JupyterLab LaTeX typesetter links did not enforce `noopener` attribute
Links generated with LaTeX typesetters in Markdown files and Markdown cells in JupyterLab and Jupyter Notebook did not include the `noopener` attribute.
This is deemed to have no impact on the default installations. Theoretically users of third-party LaTeX-rendering extensions could find themselves vulnerable to reverse tabnabbing attacks if:
- links generated by those extensions included `target=_blank` (no such extensions are known at time of writing) and
- they were to click on a link generated in LaTeX (typically visibly different from other links).
For consistency with handling on other links, new versions of JupyterLab will enforce `noopener` and `target=_blank` on all links generated by typesetters. The former
Red Hat
jupyterlab: JupyterLab LaTeX typesetter links did not enforce `noopener` attribute
vendor_redhat·2025-09-26·CVSS 2.1
CVE-2025-59842 [LOW] CWE-1022 jupyterlab: JupyterLab LaTeX typesetter links did not enforce `noopener` attribute
jupyterlab: JupyterLab LaTeX typesetter links did not enforce `noopener` attribute
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to version 4.4.8, links generated with LaTeX typesetters in Markdown files and Markdown cells in JupyterLab and Jupyter Notebook did not include the noopener attribute. This is deemed to have no impact on the default installations. Theoretically users of third-party LaTeX-rendering extensions could find themselves vulnerable to reverse tabnabbing attacks if links generated by those extensions included target=_blank (no such extensions are known at time of writing) and they were to click on a link generated in LaTeX (typically visibly different from other links). This issue ha
Debian
CVE-2025-59842: jupyterlab - jupyterlab is an extensible environment for interactive and reproducible computi...
vendor_debian·2025·CVSS 2.1
CVE-2025-59842 [LOW] CVE-2025-59842: jupyterlab - jupyterlab is an extensible environment for interactive and reproducible computi...
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to version 4.4.8, links generated with LaTeX typesetters in Markdown files and Markdown cells in JupyterLab and Jupyter Notebook did not include the noopener attribute. This is deemed to have no impact on the default installations. Theoretically users of third-party LaTeX-rendering extensions could find themselves vulnerable to reverse tabnabbing attacks if links generated by those extensions included target=_blank (no such extensions are known at time of writing) and they were to click on a link generated in LaTeX (typically visibly different from other links). This issue has been patched in version 4.4.8.
Scope: local
forky: open
sid: open
trixie: open
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-09-26
Published