Hi,

The following vulnerability was published for jupyterlab.

CVE-2025-59842[0]:
| jupyterlab is an extensible environment for interactive and
| reproducible computing, based on the Jupyter Notebook Architecture.
| Prior to version 4.4.8, links generated with LaTeX typesetters in
| Markdown files and Markdown cells in JupyterLab and Jupyter Notebook
| did not include the noopener attribute. This is deemed to have no
| impact on the default installations. Theoretically users of third-
| party LaTeX-rendering extensions could find themselves vulnerable to
| reverse tabnabbing attacks if links generated by those extensions
| included target=_blank (no such extensions are known at time of
| writing) and they were to click on a link generated in LaTeX
| (typically visibly different from other links). This issue has been
| patched in version 4.4.8.

https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-vvfj-2jqx-52jm
https://github.com/jupyterlab/jupyterlab/commit/88ef373039a8cc09f27d3814382a512d9033675c


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2025-59842
https://www.cve.org/CVERecord?id=CVE-2025-59842

Please adjust the affected versions in the BTS as needed.

We believe that the bug you reported is fixed in the latest version of
jupyterlab, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1118967@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Bastien Roucariès <rouca@debian.org> (supplier of updated jupyterlab package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 20 Jul 2026 13:43:19 +0200
Source: jupyterlab
Architecture: source
Version: 4.4.8+ds1+~3.1.0+~0.16.6+~cs1.4.4-1
Distribution: experimental
Urgency: medium
Maintainer: Debian Javascript Maintainers <pkg-javascript-devel@lists.alioth.debian.org>
Changed-By: Bastien Roucariès <rouca@debian.org>
Closes: 1118967
Changes:
 jupyterlab (4.4.8+ds1+~3.1.0+~0.16.6+~cs1.4.4-1) experimental; urgency=medium
 .
   * New upstream release
   * Fix CVE-2025-59842:
     Links generated with LaTeX typesetters in Markdown files and
     Markdown cells in JupyterLab and Jupyter Notebook did not include
     the noopener attribute.
     (Closes: #1118967)
Checksums-Sha1:
 e57feda8e20de11f979c2f6c34198d547b8d29e1 6785 jupyterlab_4.4.8+ds1+~3.1.0+~0.16.6+~cs1.4.4-1.dsc
 eb34b3ea64ee87b0a73937bf0bae5cc72ba81777 1597928 jupyterlab_4.4.8+ds1+~3.1.0+~0.16.6+~cs1.4.4.orig-jupyter-ui-toolkit.tar.xz
 1f0180cf4cbc9d9ffd840133870eb8b7a7be7b2b 97376 jupyterlab_4.4.8+ds1+~3.1.0+~0.16.6+~cs1.4.4.orig-jupyter-ydoc.tar.xz
 76cbeff51ac6b13ca1e7199e40846e205e280ff9 4780 jupyterlab_4.4.8+ds1+~3.1.0+~0.16.6+~cs1.4.4.orig-mini-svg-data-uri.tar.xz
 6a0862795f47fb9f6b9c5ff94851af53182fbfdc 19644724 jupyterlab_4.4.8+ds1+~3.1.0+~0.16.6+~cs1.4.4.orig.tar.xz
 ca706e10d6cf16300d6c3a6bd4b098a84dc4893e 22636 jupyterlab_4.4.8+ds1+~3.1.0+~0.16.6+~cs1.4.4-1.debian.tar.xz
 bfba392889b89c0be0798e25542271d6c2d6a82d 28203 jupyterlab_4.4.8+ds1+~3.1.0+~0.16.6+~cs1.4.4-1_source.buildinfo
Checksums-Sha256:
 d6788e58e95b55d16dec2c555f2f0d751d2fe7321faf15c6af121b8a5506e251 6785 jupyterlab_4.4.8+ds1+~3.1.0+~0.16.6+~cs1.4.4-1.dsc
 a5eabc67c064e96bf431307d48b7f5fd8bd4fe32156a270c4b07aee4607ca828 1597928 jupyterlab_4.4.8+ds1+~3.1.0+~0.16.6+~cs1.4.4.orig-jupyter-ui-toolkit.tar.xz
 8afd6186534f2cb6037103c1101211cc6cf21ecf735923157957adb474887784 97376 jupyterlab_4.4.8+ds1+~3.1.0+~0.16.6+~cs1.4.4.orig-jupyter-ydoc.tar.xz
 54bf2f94b9809e10224766d91e9c778cada0f7e07fda42f3071002d6fa010cc7 4780 jupyterlab_4.4.8+ds1+~3.1.0+~0.16.6+~cs1.4.4.orig-mini-svg-data-uri.tar.xz
 5c172dfe6210cbe4a8162302702f26c8658496cfdd5700330ee12777d3fab347 19644724 jupyterlab_4.4.8+ds1+~3.1.0+~0.16.6+~cs1.4.4.orig.tar.xz
 c1bd629ab3ee16564d0292f07c0c99f61f591d2392c1e54219bd64de7a6ebe0d 22636 jupyterlab_4.4.8+ds1+~3.1.0+~0.16.6+~cs1.4.4-1.debian.tar.xz
 92c8a690c93846066643869988963a9b5cc61055d7d98fd5c4b47b05cf8c1453 28203 jupyterlab_4.4.8+ds1+~3.1.0+~0.16.6+~cs1.4.4-1_source.buildinfo
Files:
 2c217391261a4ad836a980006bb10257 6785 javascript optional jupyterlab_4.4.8+ds1+~3.1.0+~0.16.6+~cs1.4.4-1.dsc
 52848eb1b1e253029383dc18606526d1 1597928 javascript optional jupyterlab_4.4.8+ds1+~3.1.0+~0.16.6+~cs1.4.4.orig-jupyter-ui-toolkit.tar.xz
 a65317257cd84125c53cbbf15381fbd1 97376 javascript optional jupyterlab_4.4.8+ds1+~3.1.0+~0.16.6+~cs1.4.4.orig-jupyter-ydoc.tar.xz
 bb699f5f37e7bcae34413fd523a58559 4780 javascript optional jupyterlab_4.4.8+ds1+~3.1.0+~0.16.6+~cs1.4.4.orig-mini-svg-data-uri.tar.xz
 3e93e126474e9318588af9fc7432adfb 19644724 javascript optional jupyterlab_4.4.8+ds1+~3.1.0+~0.16.6+~cs1.4.4.orig.tar.xz
 5b2bbbb89563925808edbcc0aafa1eab 22636 javascript optional jupyterlab_4.4.8+ds1+~3.1.0+~0.16.6+~cs1.4.4-1.debian.tar.xz
 731d99a430ba319fe1019c3236611525 28203 javascript optional jupyterlab_4.4.8+ds1+~3.1.0+~0.16.6+~cs1.4.4-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

wsG7BAEBCgBvBYJqXgo8CRAAOhotqkEIX0cUAAAAAAAeACBzYWx0QG5vdGF0aW9u
cy5zZXF1b2lhLXBncC5vcmf23+eJ8JQN7I3HhU0Z1YfkI47oWbhCEbyvJp0pmTFz
NBYhBF0Bh7lAokW617D1agA6Gi2qQQhfAADlahAAo78cMkjXYI+1ntTlCQlp3OhX
7NAOMlH5ApXoOA0D+SRZqcop+RRnWdIK187Dd2XqqC77u5u6Sp0UEVX8QBCH3mB6
8BP/nOvxYbqhhMiJdaLbvu3ka0NCXRKOLcLg3RTHa0Hz2UZ8ZWOy/2hcOWdYxcZ3
OLU6mltm+fZy9X2oPTgK1x4II7Qs3JeU1qucihOesMr6H/o0HvXnWf8k1QI65Vcm
IBc4mX7Wz+0m1j8YAVGKDr+nL5Hx46SbMZlUeJOkPm1bQhz9zu2GiIzleNlWeEeH
6yCDNVhBJpkmxSm5lwW8YRltc/aERc/T5TDhvBBX01Zd5Hyg1iUHEV2YlROuqDCx
ZXJvwEGHHYGbJgycODGOCC3I+oRItY+r7+HkLMVIoOcY+CHRU3gGjFHJirkXcVMP
RQl8WVUutMXPW+3FheKDKGkVngSr/BO9DMv9S1UyAtWVWygsb9bVmStIQfKWv1b/
/wPxAHExupVI2hxIPwrMPBdN5iEpCcfzX6MxE/Lg9lxNSgUo7iNLhIK3hetNsYnQ
CInwDcpZQM4Him3lwKVaEuf+WQoJLDY+9cktusO+21GQlLOhwYkDBYgPWHuGJ6wC
MDaEgvVd0DiFecTHVTFkxVKkbz/zX+9jZNDk8ftEgxYsxBXtFGEcY4A1FQekiRz4
2YaM99ylZHuCqWYZvj0=
=T6wT
-----END PGP SIGNATURE-----