De3Erve-Hunter

**Name of the Vulnerable Software and Affected Versions** JupyterLab versions 4.6.0 through 4.6.1 JupyterLab versions 4.5.0 through 4.5.9 **Description** An enforcement gap exists in the `PyPIExtensionManager.install()` function due to a missing `await` keyword, which prevents the `is install allowed` coroutine from executing. This results in the extension allowlist or blocklist not being enforced for direct callers of the `install()` function. This issue specifically affects deployments where a custom extension or downstream integration imports `PyPIExtensionManager` and calls `install()` using a package name influenced by untrusted input, while the PyPI Extension Manager is enabled, an allowlist/blocklist is configured, and kernels and terminals are either disabled or delegated to remote hosts. The standard JupyterLab HTTP API and Extension Manager UI are not affected. **Recommendations** Update JupyterLab versions 4.6.0 through 4.6.1 to version 4.6.2. Update JupyterLab versions 4.5.0 through 4.5.9 to version 4.5.10.

**Name of the Vulnerable Software and Affected Versions** PasswordPusher versions prior to 2.9.2 **Description** An issue exists where passphrase-protected pushes are susceptible to brute-force attacks. The 'POST /p/:token/access' endpoint lacks route-specific rate limiting and per-push lockout mechanisms. This allows an attacker who possesses a push token to systematically guess passphrases at a rate of 120 attempts per minute, potentially recovering short or dictionary-derived passphrases within hours or days. **Recommendations** Update to version 2.9.2 or later.