PT-2026-71917 · Project Jupyter · Jupyterlab
CVE-2026-73416
·
Published
2026-07-22
·
Updated
2026-08-28
CVSS v4.0
6.1
Medium
| Vector | AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
jupyterlab versions 4.5.0 through 4.5.9
jupyterlab versions 4.6.0 through 4.6.1
Description
The PyPI extension manager in JupyterLab fails to properly enforce
blocked extensions uris because it uses a custom normalization process that is weaker than PyPI package-name canonicalization. This allows an authenticated user to bypass installation restrictions by requesting a PyPI-equivalent spelling of a blocklisted package, which is then resolved to the same package by pip. This issue can lead to the installation of prohibited extensions, defeating integrity restrictions and affecting availability, provided that an allowlist or blocklist is in place and kernels or terminals are disabled or delegated to remote hosts. The flaw exists within the jupyterlab/extensions/manager.py and jupyterlab/extensions/pypi.py files.Recommendations
Update to version 4.5.10.
Update to version 4.6.2.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Jupyterlab