[Debian-pan-maintainers] Bug#1118967: jupyterlab: CVE-2025-59842

[Moritz Mühlenhoff]

Source: jupyterlab
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security

Hi,

The following vulnerability was published for jupyterlab.

CVE-2025-59842[0]:
| jupyterlab is an extensible environment for interactive and
| reproducible computing, based on the Jupyter Notebook Architecture.
| Prior to version 4.4.8, links generated with LaTeX typesetters in
| Markdown files and Markdown cells in JupyterLab and Jupyter Notebook
| did not include the noopener attribute. This is deemed to have no
| impact on the default installations. Theoretically users of third-
| party LaTeX-rendering extensions could find themselves vulnerable to
| reverse tabnabbing attacks if links generated by those extensions
| included target=_blank (no such extensions are known at time of
| writing) and they were to click on a link generated in LaTeX
| (typically visibly different from other links). This issue has been
| patched in version 4.4.8.

https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-vvfj-2jqx-52jm
https://github.com/jupyterlab/jupyterlab/commit/88ef373039a8cc09f27d3814382a512d9033675c


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2025-59842
    https://www.cve.org/CVERecord?id=CVE-2025-59842

Please adjust the affected versions in the BTS as needed.