Muffanuj

**Name of the Vulnerable Software and Affected Versions** JupyterLab versions 4.1.0 through 4.5.9 JupyterLab versions 4.6.0 through 4.6.1 **Description** A plugin manager lock-rule enforcement bypass exists where server-side gaps allow an authenticated user to circumvent administrator lock rules. By making direct requests to the '/lab/api/plugins' endpoint, a user can enable or disable locked plugins, including child plugins of multi-plugin extensions and those locked via the 'lock all' mechanism. This may lead to compromised data integrity and the bypass of hardening restrictions, such as download or upload limits, established through locked plugins. **Recommendations** Update versions 4.1.0 through 4.5.9 to version 4.5.10. Update versions 4.6.0 through 4.6.1 to version 4.6.2.

**Name of the Vulnerable Software and Affected Versions** JupyterLab versions 4.6.0 through 4.6.1 JupyterLab versions 4.5.0 through 4.5.9 **Description** An enforcement gap exists in the `PyPIExtensionManager.install()` function due to a missing `await` keyword, which prevents the `is install allowed` coroutine from executing. This results in the extension allowlist or blocklist not being enforced for direct callers of the `install()` function. This issue specifically affects deployments where a custom extension or downstream integration imports `PyPIExtensionManager` and calls `install()` using a package name influenced by untrusted input, while the PyPI Extension Manager is enabled, an allowlist/blocklist is configured, and kernels and terminals are either disabled or delegated to remote hosts. The standard JupyterLab HTTP API and Extension Manager UI are not affected. **Recommendations** Update JupyterLab versions 4.6.0 through 4.6.1 to version 4.6.2. Update JupyterLab versions 4.5.0 through 4.5.9 to version 4.5.10.