CVE-2026-73626

Name of the Vulnerable Software and Affected Versions JupyterLab versions 4.6.0 through 4.6.1 JupyterLab versions 4.5.0 through 4.5.9

Description An enforcement gap exists in the PyPIExtensionManager.install() function due to a missing await keyword, which prevents the is install allowed coroutine from executing. This results in the extension allowlist or blocklist not being enforced for direct callers of the install() function. This issue specifically affects deployments where a custom extension or downstream integration imports PyPIExtensionManager and calls install() using a package name influenced by untrusted input, while the PyPI Extension Manager is enabled, an allowlist/blocklist is configured, and kernels and terminals are either disabled or delegated to remote hosts. The standard JupyterLab HTTP API and Extension Manager UI are not affected.

Recommendations Update JupyterLab versions 4.6.0 through 4.6.1 to version 4.6.2. Update JupyterLab versions 4.5.0 through 4.5.9 to version 4.5.10.