# JupyterLab Desktop 4.6.2-1 is out: critical security patches

**URL:** <https://discourse.jupyter.org/t/jupyterlab-desktop-4-6-2-1-is-out-critical-security-patches/38799>\
**Category:** JupyterLab\
**Tags:** security\
**Created:** [July 24, 2026, 11:00am UTC](https://discourse.jupyter.org/t/jupyterlab-desktop-4-6-2-1-is-out-critical-security-patches/38799 "2026-07-24T11:00:09Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![krassowski](https://yyz1.discourse-cdn.com/flex031/user_avatar/discourse.jupyter.org/krassowski/32/1685_2.png) [@krassowski](https://discourse.jupyter.org/u/krassowski)\
**Post date:** [July 24, 2026, 11:00am UTC](https://discourse.jupyter.org/t/jupyterlab-desktop-4-6-2-1-is-out-critical-security-patches/38799/1 "2026-07-24T11:00:09Z")

</div>

After a two-year long hiatus, JupyterLab Desktop 4.6.2-1 is out with patches for two critical and two moderate severity vulnerabilities:

> **[Release v4.6.2-1 · jupyterlab/jupyterlab-desktop](https://github.com/jupyterlab/jupyterlab-desktop/releases/tag/v4.6.2-1)**
>
> JupyterLab Desktop v4.6.2-1
> This is a first release in 2 years, catching up with the latest JupyterLab 4.6.2 and a stable, supported Electron version. This release includes patches for four securit...

- [GHSA-vrj4-r4fw-9rfh](https://github.com/jupyterlab/jupyterlab-desktop/security/advisories/GHSA-vrj4-r4fw-9rfh) - pasting a malicious server URL into the connect dialog could lead to remote code execution (XSS)
- [GHSA-2mr8-962v-wc67](https://github.com/jupyterlab/jupyterlab-desktop/security/advisories/GHSA-2mr8-962v-wc67) - one-click server token leak in untrusted notebook leading to remote code execution
- [GHSA-8cvf-4977-r95v](https://github.com/jupyterlab/jupyterlab-desktop/security/advisories/GHSA-8cvf-4977-r95v) CVE-2025-54991 - local attacker could inject code into app process to bypass macOS privacy controls (TCC)
- [GHSA-5c3f-5gj7-p9xh](https://github.com/jupyterlab/jupyterlab-desktop/security/advisories/GHSA-5c3f-5gj7-p9xh) CVE-2025-55002 - local attacker could run arbitrary code in app context to bypass macOS privacy controls (TCC)

plus all patches inherited from JupyterLab 4.6.2 [Security releases: JupyterLab v4.6.2 and v4.5.10](https://discourse.jupyter.org/t/security-releases-jupyterlab-v4-6-2-and-v4-5-10/38794/1)