CVE-2025-59842 JupyterLab LaTeX typesetter links did not enforce `noopener` attribute
JupyterLab LaTeX links lacked noopener, enabling reverse tabnabbing in specific third-party extension scenarios.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-59842?
CVE-2025-59842 is a low-severity vulnerability in jupyterlab, published on 26 Sep 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to version 4.4.8, links generated with LaTeX typesetters in Markdown files and Markdown cells in JupyterLab and Jupyter Notebook did not include the noopener attribute. This is deemed to have no impact on the default installations. Theoretically users of third-party LaTeX-rendering extensions could find themselves vulnerable to reverse tabnabbing attacks if links generated by those extensions included target=_blank (no such extensions are known at time of writing) and they were to click on a link generated in LaTeX (typically visibly different from other links). This issue has been patched in version 4.4.8.
Weakness: CWE-1022
Which versions are affected by CVE-2025-59842?
4 open source packages ship an affected version, including jupyterlab. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
jupyterlab Bitnami | All versions | 4.4.8 |
jupyterlab PyPI | All versions | 4.4.8 |
jupyterlab PyPI | All versions | 4.4.8 |
jupyterlab PyPI | All versions | 4.4.8 |
Linux distribution packages (1)
python-jupyterlab openSUSE:Tumbleweed | All versions | 4.4.9-1.1 |
Products include Jupyter Jupyterlab.
How do I fix CVE-2025-59842?
Upgrade jupyterlab to 4.4.8 or later.
Is CVE-2025-59842 being exploited?
There is no known exploitation of CVE-2025-59842 in the wild and no public exploit code.
Other vulnerabilities in jupyterlab
- CVE-2024-39700 Remote Code Execution (RCE) vulnerability in jupyterlab extension template `update-integration-tests` GitHub Action
- CVE-2026-42266 JupyterLab has an Extension Manager API/GUI Policy Discrepancy, allowing 3rd party (malicious) extensions install via POST request
- CVE-2026-42557 jupyterlab: Command linker attributes in HTML enable one-click command execution from untrusted content
- CVE-2024-43805 HTML injection in Jupyter Notebook and JupyterLab leading to DOM Clobbering
- CVE-2021-32797 JupyterLab: XSS due to lack of sanitization of the action attribute of an html <form>
Sources
Also known as BIT-jupyterlab-2025-59842, DEBIAN-CVE-2025-59842, GHSA-vvfj-2jqx-52jm, PYSEC-2026-1482, UBUNTU-CVE-2025-59842, openSUSE-SU-2025:15591-1.