CVE-2025-55002: RunAsNode fuse enables macOS TCC

CISO Take

JupyterLab Desktop for macOS before 4.6.2-1 shipped with Electron's RunAsNode fuse enabled. Any process already running as the current user can set ELECTRON_RUN_AS_NODE and execute arbitrary Node.js code inside the app, inheriting the macOS privacy (TCC) permissions the user previously granted to it, such as access to Documents, Desktop and Downloads. This is a post-compromise privilege-boundary issue, not an initial access or remote vector. It is rated medium (CVSS 5.5, local, low privileges, no user interaction). It is not in CISA KEV, no public exploit or Nuclei template is known, and no EPSS data is available. The risk is concentrated on data scientist and ML engineer Macs, where notebooks often sit next to datasets, credentials and model artifacts. Upgrade JupyterLab Desktop to 4.6.2-1 or later on all macOS endpoints and review which folders the app has TCC grants for.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

Low to medium. Exploitation requires existing local code execution as the user plus previously granted TCC permissions, so it works as a post-compromise step that widens data access, not as an entry point. Attack complexity is low once a foothold exists. The CVSS vector rates confidentiality impact as high and integrity and availability as none. No KEV listing, public exploit or scanner template is known, and EPSS is unavailable, so near-term mass exploitation is unlikely. Windows and Linux are not affected.

How does the attack unfold?

Initial foothold

Attacker already executes code as the current user on the macOS machine, for example through malware or a malicious dependency.

AML.T0011.001

Execution via RunAsNode

Attacker launches the JupyterLab Desktop binary with ELECTRON_RUN_AS_NODE to run arbitrary Node.js code in the app context.

AML.T0050

TCC permission inheritance

The injected code inherits the app's granted access to Documents, Desktop and Downloads without a new macOS prompt.

AML.T0107

Data access and exfiltration

Attacker reads protected notebooks, datasets and credentials and sends them out of the environment.

AML.T0037

Initial foothold

Attacker already executes code as the current user on the macOS machine, for example through malware or a malicious dependency.

AML.T0011.001

Execution via RunAsNode

Attacker launches the JupyterLab Desktop binary with ELECTRON_RUN_AS_NODE to run arbitrary Node.js code in the app context.

AML.T0050

TCC permission inheritance

The injected code inherits the app's granted access to Documents, Desktop and Downloads without a new macOS prompt.

AML.T0107

Data access and exfiltration

Attacker reads protected notebooks, datasets and credentials and sends them out of the environment.

AML.T0037

How severe is it?

CVSS 3.1

5.5 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVLocal

ACLow

PRLow

UINone

SUnchanged

CHigh

INone

ANone

What should I do?

1 step

1) Upgrade JupyterLab Desktop to 4.6.2-1 or later on all macOS systems, and inventory installed versions via MDM or EDR. 2) Audit TCC grants (System Settings > Privacy & Security) and revoke unnecessary Documents, Desktop and Downloads access for JupyterLab Desktop. 3) Detect execution of the JupyterLab Desktop binary with ELECTRON_RUN_AS_NODE in the environment or unusual Node.js child process activity, using EDR or Endpoint Security telemetry. 4) Keep sensitive datasets and credentials out of broadly TCC-granted folders. 5) Apply standard hygiene to untrusted notebooks and packages to reduce the chance of the initial foothold.

How is it classified?

Code ExecutionData LeakageFrameworkAML.T0037- Data from Local System AML.T0050- Command and Scripting Interpreter AML.T0107- Exploitation for Defense Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks and mechanisms to sustain value

Frequently Asked Questions

What is CVE-2025-55002?

JupyterLab Desktop for macOS before 4.6.2-1 shipped with Electron's RunAsNode fuse enabled. Any process already running as the current user can set ELECTRON_RUN_AS_NODE and execute arbitrary Node.js code inside the app, inheriting the macOS privacy (TCC) permissions the user previously granted to it, such as access to Documents, Desktop and Downloads. This is a post-compromise privilege-boundary issue, not an initial access or remote vector. It is rated medium (CVSS 5.5, local, low privileges, no user interaction). It is not in CISA KEV, no public exploit or Nuclei template is known, and no EPSS data is available. The risk is concentrated on data scientist and ML engineer Macs, where notebooks often sit next to datasets, credentials and model artifacts. Upgrade JupyterLab Desktop to 4.6.2-1 or later on all macOS endpoints and review which folders the app has TCC grants for.

Is CVE-2025-55002 actively exploited?

No confirmed active exploitation of CVE-2025-55002 has been reported, but organizations should still patch proactively.

How to fix CVE-2025-55002?

1) Upgrade JupyterLab Desktop to 4.6.2-1 or later on all macOS systems, and inventory installed versions via MDM or EDR. 2) Audit TCC grants (System Settings > Privacy & Security) and revoke unnecessary Documents, Desktop and Downloads access for JupyterLab Desktop. 3) Detect execution of the JupyterLab Desktop binary with ELECTRON_RUN_AS_NODE in the environment or unusual Node.js child process activity, using EDR or Endpoint Security telemetry. 4) Keep sensitive datasets and credentials out of broadly TCC-granted folders. 5) Apply standard hygiene to untrusted notebooks and packages to reduce the chance of the initial foothold.

What systems are affected by CVE-2025-55002?

This vulnerability affects the following AI/ML architecture patterns: Developer and data science workstations, Notebook-based ML development environments, Local model experimentation.

What is the CVSS score for CVE-2025-55002?

CVE-2025-55002 has a CVSS v3.1 base score of 5.5 (MEDIUM).

What is the AI security impact?

Affected AI Architectures

Developer and data science workstationsNotebook-based ML development environmentsLocal model experimentation

MITRE ATLAS Techniques

AML.T0037Data from Local System

AML.T0050Command and Scripting Interpreter

AML.T0107Exploitation for Defense Evasion

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, JupyterLab Desktop for macOS shipped with Electron's RunAsNode fuse enabled, allowing ELECTRON_RUN_AS_NODE to execute arbitrary Node.js code in the application process. An attacker who can already execute code as the current user can therefore run code in JupyterLab Desktop's context and inherit TCC permissions previously granted to the application, including access to protected Documents, Desktop, or Downloads folders without another macOS prompt. Exploitation requires existing local code execution and prior TCC grants; it does not provide initial or remote code execution. Windows and Linux are not affected. This vulnerability is fixed in 4.6.2-1.

Exploitation Scenario

An attacker first obtains user-level code execution on a data scientist's Mac, for example through a malicious pip package or a trojanized notebook dependency. The malware finds that JupyterLab Desktop already holds TCC grants for Documents and Downloads. It launches the app binary with ELECTRON_RUN_AS_NODE=1 and a script that reads and exfiltrates training datasets, notebooks, exported model files and stored API keys. macOS shows no new consent prompt, because the access is attributed to the trusted application.

Weaknesses (CWE)

CWE-250Execution with Unnecessary PrivilegesPrimary CWE-693Protection Mechanism FailurePrimary CWE-94Improper Control of Generation of CodePrimary CWE-250Execution with Unnecessary Privileges CWE-693Protection Mechanism Failure CWE-94Improper Control of Generation of Code

CWE-250 — Execution with Unnecessary Privileges: The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.

[Architecture and Design, Operation] Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
[Architecture and Design] Identify the functionality that requires additional privileges, such as access to privileged operating system resources. Wrap and centralize this functionality if possible, and isolate the privileged code as much as possible from other code [REF-76]. Raise privileges as late as possible, and drop them as soon as possible to avoid CWE-271. Avoid weaknesses such as CWE-288 and CWE-420 by protecting all possible communication channels that could interact with the privileged code, such as a secondary socket that is only intended to be accessed by administrators.

Source: MITRE CWE corpus.