jupyterlab-desktop vulnerabilities
CVEs whose affected-version data names the jupyterlab-desktop package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
4 CVEsRSS
CVE-2025-54991Medium· 5.5JupyterLab Desktop: TCC Bypass via Insecure Entitlements (macOS)
JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, JupyterLab Desktop for macOS declared the com.apple.security.cs.allow-dyld-environment-variables entitlement, allowing the dynamic linker to h…
CVE-2026-86044Critical· 9.6JupyterLab Desktop: One-Click Jupyter Server Token Leak leading to Remote Code Execution
JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, JupyterLab Desktop exposed getServerInfo to the renderer without confirming that the current page still had the local Jupyter server origin. I…
CVE-2025-55002Medium· 5.5JupyterLab Desktop: TCC Bypass via Misconfigured Node Fuses
JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, JupyterLab Desktop for macOS shipped with Electron's RunAsNode fuse enabled, allowing ELECTRON_RUN_AS_NODE to execute arbitrary Node.js code i…
CVE-2026-102530Critical· 9.4JupyterLab Desktop: Cross-Site Scripting (XSS) leading to Remote Code Execution on Connect URL
JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, remote-server URLs were inserted into the server-selection dialog and Welcome view without safe encoding. An attacker who convinces a user to …