Skip to content
OpenAdvisories
Low · 2.1 CVE-2025-59842 BIT-jupyterlab-2025-59842EUVD-2025-31350GHSA-vvfj-2jqx-52jmPYSEC-2026-1482

JupyterLab LaTeX typesetter links did not enforce `noopener` attribute

Published Sep 26, 2025 · Updated Sep 26, 2025 · Assigned by GitHub_M

Description

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to version 4.4.8, links generated with LaTeX typesetters in Markdown files and Markdown cells in JupyterLab and Jupyter Notebook did not include the noopener attribute. This is deemed to have no impact on the default installations. Theoretically users of third-party LaTeX-rendering extensions could find themselves vulnerable to reverse tabnabbing attacks if links generated by those extensions included target=_blank (no such extensions are known at time of writing) and they were to click on a link generated in LaTeX (typically visibly different from other links). This issue has been patched in version 4.4.8.

Affected products

VendorProductAffectedFixed
jupyterlab jupyterlab < 4.4.8 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 jupyterlab 4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-3 —
Debian 13 jupyterlab No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 jupyterlab No fix yet —
Ubuntu 26.04 LTS jupyterlab No fix yet —
Ubuntu 25.10 jupyterlab No fix yet —
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed python-jupyterlab 4.4.9-1.1 openSUSE-SU-2025:15591-1

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling jupyter-docker-base +1 999.9.9_git20260925-r0 —
Wolfi rolling kubeflow-pipelines-visualization-server 2.14.3-r1 —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI jupyterlab < 4.4.8 4.4.8 GHSA-vvfj-2jqx-52jm

Advisories 1

References