Executive brief
JupyterLab LaTeX typesetter links did not enforce `noopener` attribute
Affected products
- PyPI jupyterlab
Junglewise Threat Intelligence
CVE-2025-59842: PYSEC-2026-1482 - JupyterLab LaTeX typesetter links did not enforce `noopener` attribute
CVE-2025-59842 · Severity: medium · CVSS 4 · Published 2026-07-07
Technologies: jupyterlab (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-3671 - JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab
- JupyterLab arbitrary code execution via malicious overrides.json
- JupyterLab extension blocklist bypass via package name variant
- PYSEC-2026-2682 - Jupyter Notebook Vulnerable to Authentication Token Theft via CommandLinker XSS
- PYSEC-2026-2536 - HTML injection in Jupyter Notebook and JupyterLab leading to DOM Clobbering