[From nobody Mon Jul 20 12:59:08 2026
Received: (at submit) by bugs.debian.org; 25 Oct 2025 22:07:59 +0000
X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02
 (2024-03-25) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-4.9 required=4.0 tests=BAYES_00,FOURLA,
 FVGT_m_MULTI_ODD,MD5_SHA1_SUM,SPF_HELO_NONE,SPF_PASS autolearn=ham
 autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 29; hammy, 141; neutral, 45; spammy,
 1. spammytokens:0.977-+--click
 hammytokens:0.000-+--UD:security-tracker.debian.org,
 0.000-+--securitytrackerdebianorg,
 0.000-+--security-tracker.debian.org, 0.000-+--H*r:jmm,
 0.000-+--H*M:westfalen
Return-path: <jmm@inutil.org>
Received: from vps-b7ad3695.vps.ovh.net ([51.38.114.215]:57292)
 by buxtehude.debian.org with esmtps
 (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256)
 (Exim 4.96) (envelope-from <jmm@inutil.org>) id 1vCmQY-00D537-0F
 for submit@bugs.debian.org; Sat, 25 Oct 2025 22:07:59 +0000
Received: from soju.fritz.box (p5089abef.dip0.t-ipconnect.de [80.137.171.239])
 by vps-b7ad3695.vps.ovh.net (Postfix) with ESMTPSA id 642C71A2
 for <submit@bugs.debian.org>; Sat, 25 Oct 2025 22:07:56 +0000 (UTC)
Received: from jmm by soju.fritz.box with local (Exim 4.98.2)
 (envelope-from <jmm@soju.westfalen.local>) id 1vCmQT-000000001Pn-44Lt
 for submit@bugs.debian.org; Sun, 26 Oct 2025 00:07:53 +0200
Date: Sun, 26 Oct 2025 00:07:53 +0200
To: submit@bugs.debian.org
Subject: jupyterlab: CVE-2025-59842
Message-ID: <aP1KOelRGuSgvKYw@pisco.westfalen.local>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
From: =?UTF-8?Q?Moritz_M=C3=BChlenhoff?= <jmm@inutil.org>
Delivered-To: submit@bugs.debian.org

Source: jupyterlab
X-Debbugs-CC: team@security.debian.org
Severity: important
Tags: security

Hi,

The following vulnerability was published for jupyterlab.

CVE-2025-59842[0]:
| jupyterlab is an extensible environment for interactive and
| reproducible computing, based on the Jupyter Notebook Architecture.
| Prior to version 4.4.8, links generated with LaTeX typesetters in
| Markdown files and Markdown cells in JupyterLab and Jupyter Notebook
| did not include the noopener attribute. This is deemed to have no
| impact on the default installations. Theoretically users of third-
| party LaTeX-rendering extensions could find themselves vulnerable to
| reverse tabnabbing attacks if links generated by those extensions
| included target=_blank (no such extensions are known at time of
| writing) and they were to click on a link generated in LaTeX
| (typically visibly different from other links). This issue has been
| patched in version 4.4.8.

https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-vvfj-2jqx-52jm
https://github.com/jupyterlab/jupyterlab/commit/88ef373039a8cc09f27d3814382a512d9033675c


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2025-59842
    https://www.cve.org/CVERecord?id=CVE-2025-59842

Please adjust the affected versions in the BTS as needed.
]