CVE-2026-73416

Name of the Vulnerable Software and Affected Versions jupyterlab versions 4.5.0 through 4.5.9 jupyterlab versions 4.6.0 through 4.6.1

Description The PyPI extension manager in JupyterLab fails to properly enforce blocked extensions uris because it uses a custom normalization process that is weaker than PyPI package-name canonicalization. This allows an authenticated user to bypass installation restrictions by requesting a PyPI-equivalent spelling of a blocklisted package, which is then resolved to the same package by pip. This issue can lead to the installation of prohibited extensions, defeating integrity restrictions and affecting availability, provided that an allowlist or blocklist is in place and kernels or terminals are disabled or delegated to remote hosts. The flaw exists within the jupyterlab/extensions/manager.py and jupyterlab/extensions/pypi.py files.

Recommendations Update to version 4.5.10. Update to version 4.6.2.