JupyterLab Desktop is the cross-platform desktop application for JupyterLab.
JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, JupyterLab Desktop for macOS shipped with Electron's RunAsNode fuse enabled, allowing ELECTRON_RUN_AS_NODE to execute arbitrary Node.js code in the application process. An attacker who can already execute code as the current user can therefore run code in JupyterLab Desktop's context and inherit TCC permissions previously granted to the application, including access to protected Documents, Desktop, or Downloads folders without another macOS prompt. Exploitation requires existing local code execution and prior TCC grants; it does not provide initial or remote code execution. Windows and Linux are no
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Jupyterlab
- Product
- jupyterlab-desktop
- CVSS v3.1
- 5.5 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Fix
- available
- Weakness
- CWE-94, CWE-250, CWE-693
- Exposure class
- Operating system, Developer platform, AI infrastructure
- NVD status
- Received
Why it ranks 34 (Notable)
- CVSS v3.1 5.5 medium
- Product class: operating system, developer platform
- Widely deployed vendor product (Jupyterlab)
- Fix available
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2025-55002 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.