Read the docs
TI-2025-44023 Aliases CVE-2025-54991

JupyterLab Desktop on macOS: TCC bypass via dyld entitlement

Priority LOW 24CWE-250Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation, Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-250 and CWE-693.

Summary

JupyterLab Desktop for macOS, before 4.6.2-1, declares the com.apple.security.cs.allow-dyld-environment-variables entitlement, which lets the dynamic linker honor DYLD_INSERT_LIBRARIES despite the hardened runtime. An attacker who already runs code as the current user can load an arbitrary dynamic library into the application process and inherit TCC permissions granted to the application, including access to protected Documents, Desktop, or Downloads folders without a further macOS prompt. Exploitation requires existing local code execution and prior TCC grants; it does not provide initial or remote code execution. Windows and Linux are not affected.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, JupyterLab Desktop for macOS declared the com.apple.security.cs.allow-dyld-environment-variables entitlement, allowing the dynamic linker to honor DYLD_INSERT_LIBRARIES despite the hardened runtime. An attacker who can already execute code as the current user can load an arbitrary dynamic library into the JupyterLab Desktop process and inherit TCC permissions previously granted to the application, including access to protected Documents, Desktop, or Downloads folders without another macOS prompt. Exploitation requires existing local code execution and prior TCC grants; it does not provide initial or remote code execution. Windows and Linux are not affected. This vulnerability is fixed in 4.6.2-1.

Why it matters now

EPSS 0.00192 8th percentileScored 2026-11-07
Fix Fixed jupyterlab-desktop (jupyterlab): 4.6.2-1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
jupyterlabjupyterlab-desktopbefore 4.6.2-14.6.2-1Patch availableCNA
  • jupyterlab-desktop Vendorjupyterlab Affected before 4.6.2-1 Fixed in 4.6.2-1 Patch available CNA

Remediation

Upgrade JupyterLab Desktop to 4.6.2-1 or later, which removes the entitlement. The vendor, jupyterlab, lists 4.6.2-1 as the fixed version for the jupyterlab-desktop product.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA jupyterlab-desktop (jupyterlab) Fixed in 4.6.2-1

Timeline

  1. 2026-11-06 Threatist record created from CVE-2025-54991
  2. 2026-11-08 Priority changed: MEDIUM → LOW

References

Other 3

  • TI-2026-32161 Jupyter Enterprise Gateway Has Kubernetes Manifest Injection via Jinja2 Template Rendering CVSS 4.0CRITICAL 10.0
  • TI-2026-32160 Jupyter Enterprise Gateway: Jinja2 Template Server Side Template Injection results in Remote Code Execution CVSS 4.0CRITICAL 10.0
  • TI-2026-32159 Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_prohibited_ids can be Bypassed CVSS 3.1CRITICAL 9.8
  • TI-2024-26623 Remote Code Execution (RCE) vulnerability in jupyterlab extension template `update-integration-tests` GitHub Action CVSS 3.1CRITICAL 10.0
  • TI-2026-78983 Path traversal in nbconvert lets crafted notebooks write files CVSS 4.0HIGH 8.8
  • TI-2026-39372 JupyterLab Git: Stored XSS leading to RCE CVSS 4.0CRITICAL 9.3
See all 89 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences