JupyterLab Desktop: TCC Bypass via Misconfigured Node Fuses

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, JupyterLab Desktop for macOS shipped with Electron's RunAsNode fuse enabled, allowing ELECTRON_RUN_AS_NODE to execute arbitrary Node.js code in the application process. An attacker who can already execute code as the current user can therefore run code in JupyterLab Desktop's context and inherit TCC permissions previously granted to the application, including access to protected Documents, Desktop, or Downloads folders without another macOS prompt. Exploitation requires existing local code execution and prior TCC grants; it does not provide initial or remote code execution. Windows and Linux are not affected. This vulnerability is fixed in 4.6.2-1.

Etkilenen sürümler1 yazılım

Kaynaklar5 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…esktop/security/advisories/GHSA-5c3f-5gj7-p9xh Diğer
• github.com/…ommit/5ea4bf3323b0b7acc943a867522819a7064bec38 Diğer
• github.com/…erlab/jupyterlab-desktop/releases/tag/v4.6.2-1 Diğer

Kayıt geçmişi

1. 6 Kas 2026 23:32Yayımlandı

İlgili açıklar

• 9,4 CVE-2026-102530JupyterLab Desktop: Cross-Site Scripting (XSS) leading to Remote Code Execution on Connect URL
• 9,6 CVE-2026-86044JupyterLab Desktop: One-Click Jupyter Server Token Leak leading to Remote Code Execution
• 5,5 CVE-2025-54991JupyterLab Desktop: TCC Bypass via Insecure Entitlements (macOS)
• 8,3 CVE-2026-123675OpenBMB Internet of Agents Code Executor aracında kod enjeksiyonu açığı
• 8,2 CVE-2026-119170CPython 3.14.10 hashlib modülünde FIPS hash algoritması denetimi regresyonu
• 5,4 CVE-2026-103908AMP for WP <= 1.1.18 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Author Biographical Info