CVE-2025-54991

Name of the Vulnerable Software and Affected Versions JupyterLab Desktop versions prior to 4.6.2-1

Description JupyterLab Desktop for macOS declared the com.apple.security.cs.allow-dyld-environment-variables entitlement, which allows the dynamic linker to honor DYLD INSERT LIBRARIES despite the hardened runtime. A local attacker with the ability to execute code as the current user can load an arbitrary dynamic library into the process. This allows the attacker to inherit TCC (Transparency, Consent, and Control) permissions previously granted to the application, enabling access to protected folders such as Documents, Desktop, or Downloads without triggering additional macOS prompts. This issue requires existing local code execution and prior TCC grants.

Recommendations Update to version 4.6.2-1.