Threats affecting pkg:github/jupyterlab/jupyterlab-desktop

JupyterLab Desktop versions prior to 4.6.2-1 contain a critical cross-site scripting (XSS) vulnerability. This flaw allows an attacker to execute arbitrary JavaScript code in the Welcome renderer by submitting crafted remote-server URLs, potentially leading to arbitrary code execution with the user's privileges. The vulnerability also involves unsafe rendering of RSS news-feed titles, which could be exploited if an attacker controls the content of the Jupyter Blog feed or its cached data. The issue affects all supported platforms and is fixed in version 4.6.2-1.

JupyterLab Desktop for macOS versions prior to 4.6.2-1 contains a code injection vulnerability due to Electron's RunAsNode fuse being enabled. This allows an attacker with existing local code execution and prior TCC permissions to execute arbitrary Node.js code within the application's context, potentially accessing protected macOS folders without additional prompts. Windows and Linux versions are not affected. The issue is fixed in version 4.6.2-1.

JupyterLab Desktop versions prior to 4.6.2-1 contain an open redirect vulnerability (CWE-601) that allows an attacker to craft a malicious link in an untrusted notebook. When a user opens this notebook and clicks the link, the application navigates to an attacker-controlled site which can then access sensitive local server information and authentication tokens. This enables the attacker to use the Jupyter REST API to create and trust a notebook that executes arbitrary code as the victim. The vulnerability is fixed in version 4.6.2-1.

JupyterLab Desktop for macOS versions prior to 4.6.2-1 improperly declared an entitlement allowing dynamic linker environment variables to be honored despite the hardened runtime. This enables an attacker with existing local code execution and prior TCC permissions to load arbitrary dynamic libraries into the application process and inherit its permissions, including access to protected user folders without additional macOS prompts. Windows and Linux versions are not affected. The issue is fixed in version 4.6.2-1.