Search

Find a vulnerability

Search criteria

    4 vulnerabilities found for jupyterlab-desktop by jupyterlab

    CVE-2026-102530 (GCVE-0-2026-102530)

    Vulnerability from cvelistv5 – Published: 2026-11-06 20:35 – Updated: 2026-11-09 22:43
    VLAI
    Title
    JupyterLab Desktop: Cross-Site Scripting (XSS) leading to Remote Code Execution on Connect URL
    Summary
    JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, remote-server URLs were inserted into the server-selection dialog and Welcome view without safe encoding. An attacker who convinces a user to submit a crafted URL can execute JavaScript in the Welcome renderer and abuse its privileged IPC bridge to execute arbitrary code with the user’s privileges. The Welcome view also unsafely renders RSS news-feed titles; exploitation through this separate input path requires control over content delivered through the application’s Jupyter Blog feed or its cached feed data, rather than submission of a remote-server URL. This issue affects all supported platforms and is fixed in version 4.6.2-1.
    Severity
    9.4 (Critical)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-11-09 22:36 UTC
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    • CWE-94 - Improper Control of Generation of Code ('Code Injection')
    • CWE-116 - Improper Encoding or Escaping of Output
    Assigner
    GitHub_M CNA
    References
    Impacted products
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-102530",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-09T22:36:10.314722Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-09T22:43:14.942Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "jupyterlab-desktop",
          "vendor": "jupyterlab",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.6.2-1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, remote-server URLs were inserted into the server-selection dialog and Welcome view without safe encoding. An attacker who convinces a user to submit a crafted URL can execute JavaScript in the Welcome renderer and abuse its privileged IPC bridge to execute arbitrary code with the user\u2019s privileges. The Welcome view also unsafely renders RSS news-feed titles; exploitation through this separate input path requires control over content delivered through the application\u2019s Jupyter Blog feed or its cached feed data, rather than submission of a remote-server URL. This issue affects all supported platforms and is fixed in version 4.6.2-1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-116",
              "description": "CWE-116: Improper Encoding or Escaping of Output",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T20:35:53.731Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/jupyterlab/jupyterlab-desktop/security/advisories/GHSA-vrj4-r4fw-9rfh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/jupyterlab/jupyterlab-desktop/security/advisories/GHSA-vrj4-r4fw-9rfh"
        },
        {
          "name": "https://github.com/jupyterlab/jupyterlab-desktop/commit/f59fd4f61bc6a2ca89cf0d13dce5f60511eaef5d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jupyterlab/jupyterlab-desktop/commit/f59fd4f61bc6a2ca89cf0d13dce5f60511eaef5d"
        },
        {
          "name": "https://github.com/jupyterlab/jupyterlab-desktop/releases/tag/v4.6.2-1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jupyterlab/jupyterlab-desktop/releases/tag/v4.6.2-1"
        }
      ],
      "source": {
        "advisory": "GHSA-vrj4-r4fw-9rfh",
        "discovery": "UNKNOWN"
      },
      "title": "JupyterLab Desktop: Cross-Site Scripting (XSS) leading to Remote Code Execution on Connect URL"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-102530",
    "datePublished": "2026-11-06T20:35:53.731Z",
    "dateReserved": "2026-09-29T13:00:21.387Z",
    "dateUpdated": "2026-11-09T22:43:14.942Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2025-55002 (GCVE-0-2025-55002)

    Vulnerability from cvelistv5 – Published: 2026-11-06 20:32 – Updated: 2026-11-11 03:29
    VLAI
    Title
    JupyterLab Desktop: TCC Bypass via Misconfigured Node Fuses
    Summary
    JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, JupyterLab Desktop for macOS shipped with Electron's RunAsNode fuse enabled, allowing ELECTRON_RUN_AS_NODE to execute arbitrary Node.js code in the application process. An attacker who can already execute code as the current user can therefore run code in JupyterLab Desktop's context and inherit TCC permissions previously granted to the application, including access to protected Documents, Desktop, or Downloads folders without another macOS prompt. Exploitation requires existing local code execution and prior TCC grants; it does not provide initial or remote code execution. Windows and Linux are not affected. This vulnerability is fixed in 4.6.2-1.
    Severity
    5.5 (Medium)
    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-11-11 03:29 UTC
    CWE
    • CWE-94 - Improper Control of Generation of Code ('Code Injection')
    • CWE-250 - Execution with Unnecessary Privileges
    • CWE-693 - Protection Mechanism Failure
    Assigner
    GitHub_M CNA
    References
    Impacted products
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-55002",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-11T03:29:38.969959Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-11T03:29:50.069Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "jupyterlab-desktop",
          "vendor": "jupyterlab",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.6.2-1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, JupyterLab Desktop for macOS shipped with Electron\u0027s RunAsNode fuse enabled, allowing ELECTRON_RUN_AS_NODE to execute arbitrary Node.js code in the application process. An attacker who can already execute code as the current user can therefore run code in JupyterLab Desktop\u0027s context and inherit TCC permissions previously granted to the application, including access to protected Documents, Desktop, or Downloads folders without another macOS prompt. Exploitation requires existing local code execution and prior TCC grants; it does not provide initial or remote code execution. Windows and Linux are not affected. This vulnerability is fixed in 4.6.2-1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-250",
              "description": "CWE-250: Execution with Unnecessary Privileges",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-693",
              "description": "CWE-693: Protection Mechanism Failure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T20:32:37.521Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/jupyterlab/jupyterlab-desktop/security/advisories/GHSA-5c3f-5gj7-p9xh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/jupyterlab/jupyterlab-desktop/security/advisories/GHSA-5c3f-5gj7-p9xh"
        },
        {
          "name": "https://github.com/jupyterlab/jupyterlab-desktop/commit/5ea4bf3323b0b7acc943a867522819a7064bec38",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jupyterlab/jupyterlab-desktop/commit/5ea4bf3323b0b7acc943a867522819a7064bec38"
        },
        {
          "name": "https://github.com/jupyterlab/jupyterlab-desktop/releases/tag/v4.6.2-1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jupyterlab/jupyterlab-desktop/releases/tag/v4.6.2-1"
        }
      ],
      "source": {
        "advisory": "GHSA-5c3f-5gj7-p9xh",
        "discovery": "UNKNOWN"
      },
      "title": "JupyterLab Desktop: TCC Bypass via Misconfigured Node Fuses"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-55002",
    "datePublished": "2026-11-06T20:32:37.521Z",
    "dateReserved": "2025-08-04T17:34:24.421Z",
    "dateUpdated": "2026-11-11T03:29:50.069Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-86044 (GCVE-0-2026-86044)

    Vulnerability from cvelistv5 – Published: 2026-11-06 20:30 – Updated: 2026-11-10 20:10
    VLAI
    Title
    JupyterLab Desktop: One-Click Jupyter Server Token Leak leading to Remote Code Execution
    Summary
    JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, JupyterLab Desktop exposed getServerInfo to the renderer without confirming that the current page still had the local Jupyter server origin. In a local managed session using JupyterLab before 4.4.8, an attacker can place a crafted MathJax link in an untrusted notebook. If a victim opens the notebook and clicks the link, the existing renderer navigates to an attacker-controlled site while retaining access to the preload bridge. The site can call getServerInfo to obtain the local server URL and authentication token, then use the Jupyter REST API to create and trust a notebook that executes arbitrary code as the victim. Users whose environment already uses JupyterLab 4.4.8 or later are unaffected because the corrected link handling breaks the first step of the chain. This vulnerability is fixed in 4.6.2-1.
    Severity
    9.6 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
    SSVC
    Exploitation: poc Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-11-10 20:10 UTC
    CWE
    • CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
    Assigner
    GitHub_M CNA
    References
    Impacted products
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-86044",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-10T20:10:21.041074Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-10T20:10:34.646Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/jupyterlab/jupyterlab-desktop/security/advisories/GHSA-2mr8-962v-wc67"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "jupyterlab-desktop",
          "vendor": "jupyterlab",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.6.2-1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, JupyterLab Desktop exposed getServerInfo to the renderer without confirming that the current page still had the local Jupyter server origin. In a local managed session using JupyterLab before 4.4.8, an attacker can place a crafted MathJax link in an untrusted notebook. If a victim opens the notebook and clicks the link, the existing renderer navigates to an attacker-controlled site while retaining access to the preload bridge. The site can call getServerInfo to obtain the local server URL and authentication token, then use the Jupyter REST API to create and trust a notebook that executes arbitrary code as the victim. Users whose environment already uses JupyterLab 4.4.8 or later are unaffected because the corrected link handling breaks the first step of the chain. This vulnerability is fixed in 4.6.2-1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-601",
              "description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T20:30:53.266Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/jupyterlab/jupyterlab-desktop/security/advisories/GHSA-2mr8-962v-wc67",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/jupyterlab/jupyterlab-desktop/security/advisories/GHSA-2mr8-962v-wc67"
        },
        {
          "name": "https://github.com/jupyterlab/jupyterlab-desktop/commit/7f8f64ae796efae77d106612c95f0edd6c5dc273",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jupyterlab/jupyterlab-desktop/commit/7f8f64ae796efae77d106612c95f0edd6c5dc273"
        },
        {
          "name": "https://github.com/jupyterlab/jupyterlab-desktop/releases/tag/v4.6.2-1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jupyterlab/jupyterlab-desktop/releases/tag/v4.6.2-1"
        }
      ],
      "source": {
        "advisory": "GHSA-2mr8-962v-wc67",
        "discovery": "UNKNOWN"
      },
      "title": "JupyterLab Desktop: One-Click Jupyter Server Token Leak leading to Remote Code Execution"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-86044",
    "datePublished": "2026-11-06T20:30:53.266Z",
    "dateReserved": "2026-09-04T19:29:21.058Z",
    "dateUpdated": "2026-11-10T20:10:34.646Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2025-54991 (GCVE-0-2025-54991)

    Vulnerability from cvelistv5 – Published: 2026-11-06 20:28 – Updated: 2026-11-09 13:22
    VLAI
    Title
    JupyterLab Desktop: TCC Bypass via Insecure Entitlements (macOS)
    Summary
    JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, JupyterLab Desktop for macOS declared the com.apple.security.cs.allow-dyld-environment-variables entitlement, allowing the dynamic linker to honor DYLD_INSERT_LIBRARIES despite the hardened runtime. An attacker who can already execute code as the current user can load an arbitrary dynamic library into the JupyterLab Desktop process and inherit TCC permissions previously granted to the application, including access to protected Documents, Desktop, or Downloads folders without another macOS prompt. Exploitation requires existing local code execution and prior TCC grants; it does not provide initial or remote code execution. Windows and Linux are not affected. This vulnerability is fixed in 4.6.2-1.
    Severity
    5.5 (Medium)
    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-11-09 13:22 UTC
    CWE
    • CWE-250 - Execution with Unnecessary Privileges
    • CWE-693 - Protection Mechanism Failure
    Assigner
    GitHub_M CNA
    References
    Impacted products
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-54991",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-09T13:22:20.769074Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-09T13:22:31.447Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "jupyterlab-desktop",
          "vendor": "jupyterlab",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.6.2-1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, JupyterLab Desktop for macOS declared the com.apple.security.cs.allow-dyld-environment-variables entitlement, allowing the dynamic linker to honor DYLD_INSERT_LIBRARIES despite the hardened runtime. An attacker who can already execute code as the current user can load an arbitrary dynamic library into the JupyterLab Desktop process and inherit TCC permissions previously granted to the application, including access to protected Documents, Desktop, or Downloads folders without another macOS prompt. Exploitation requires existing local code execution and prior TCC grants; it does not provide initial or remote code execution. Windows and Linux are not affected. This vulnerability is fixed in 4.6.2-1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-250",
              "description": "CWE-250: Execution with Unnecessary Privileges",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-693",
              "description": "CWE-693: Protection Mechanism Failure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T20:28:05.517Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/jupyterlab/jupyterlab-desktop/security/advisories/GHSA-8cvf-4977-r95v",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/jupyterlab/jupyterlab-desktop/security/advisories/GHSA-8cvf-4977-r95v"
        },
        {
          "name": "https://github.com/jupyterlab/jupyterlab-desktop/commit/302fb36caca62bbbba7bfaaf0a4966a38cbead44",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jupyterlab/jupyterlab-desktop/commit/302fb36caca62bbbba7bfaaf0a4966a38cbead44"
        },
        {
          "name": "https://github.com/jupyterlab/jupyterlab-desktop/releases/tag/v4.6.2-1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jupyterlab/jupyterlab-desktop/releases/tag/v4.6.2-1"
        }
      ],
      "source": {
        "advisory": "GHSA-8cvf-4977-r95v",
        "discovery": "UNKNOWN"
      },
      "title": "JupyterLab Desktop: TCC Bypass via Insecure Entitlements (macOS)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-54991",
    "datePublished": "2026-11-06T20:28:05.517Z",
    "dateReserved": "2025-08-04T17:34:24.420Z",
    "dateUpdated": "2026-11-09T13:22:31.447Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}