CVE-2025-55002

JupyterLab Desktop for macOS prior to 4.6.2-1 declared the com.apple.security.cs.allow-dyld-environment-variables entitlement, allowing the dynamic linker to honor DYLD_INSERT_LIBRARIES despite the hardened runtime. An attacker who can already execute code as the current user can load an arbitrary dynamic library into the JupyterLab Desktop process and inherit TCC permissions previously granted to the application, including access to protected Documents, Desktop, or Downloads folders without another macOS prompt. Exploitation requires existing local code execution and prior TCC grants; it does not provide initial or remote code execution. Windows and Linux are not affected.

JupyterLab Desktop prior to 4.6.2-1 exposed getServerInfo to the renderer without confirming that the current page still had the local Jupyter server origin. In a local managed session using JupyterLab before 4.4.8, an attacker can place a crafted MathJax link in an untrusted notebook; if the victim clicks it, the renderer navigates to an attacker-controlled site that retains access to the preload bridge, calls getServerInfo to obtain the local server URL and authentication token, and uses the Jupyter REST API to create and trust a notebook that executes arbitrary code as the victim.

JupyterLab Desktop prior to 4.6.2-1 inserted remote-server URLs into the server-selection dialog and Welcome view without safe encoding. An attacker who convinces a user to submit a crafted URL can execute JavaScript in the Welcome renderer and abuse its privileged IPC bridge to execute arbitrary code with the user's privileges; a separate path involves unsafe rendering of RSS news-feed titles.