JupyterLab Desktop Vulnerability Affects macOS Users through Node.js Execution

CVE-2025-55002

What is CVE-2025-55002?

JupyterLab Desktop for macOS prior to version 4.6.2-1 is affected by a vulnerability that allows an attacker executing code as the current user to run arbitrary Node.js code within the application's process. This occurs due to Electron's RunAsNode fuse being enabled, which permits the execution of code in the context of JupyterLab Desktop and grants access to previously authorized TCC permissions, such as protected Documents, Desktop, or Downloads folders without additional macOS prompts. It is essential to note that exploitation requires local code execution and prior TCC grants; it does not lead to initial or remote code execution. The issue is resolved in version 4.6.2-1.

References