JupyterLab CVE-2026-73626

Exploitation requires all four of the following conditions to be present simultaneously: (1) a custom extension or downstream integration must import PyPIExtensionManager and call install() directly with a package name derived from untrusted user input - the stock JupyterLab HTTP API handler and Extension Manager UI perform their own separate, correctly awaited check and are explicitly not affected; (2) an allowlist or blocklist must be actively configured with the intent of restricting which packages users may install; (3) the PyPI Extension Manager must be enabled, which is the default but can be replaced; and (4) kernels and terminals must be disabled or delegated to remote hosts, removing alternative package-installation vectors that would otherwise make this bypass redundant. PR:L in the CVSS vector confirms authenticated access is required. If any single condition is absent, this vulnerability carries no security consequence.

The CVSS 4.0 score of 7.7 with AV:N/AC:H/PR:L reflects a meaningful theoretical impact ceiling, but the SSVC assessment (Exploitation: none, Automatable: no, Technical Impact: partial) and an EPSS of 0.18% (8th percentile) together indicate that real-world exploitation is highly constrained and has not been observed. The AC:H rating accurately captures the four simultaneous non-default conditions required - a custom integration calling install() directly with untrusted input, a configured allowlist/blocklist, the PyPI Extension Manager enabled, and kernels/terminals disabled or remote. Absent any one of these, there is no security impact at all. The stock JupyterLab deployment is entirely unaffected, so even a standard institutional or organizational deployment faces no exposure from this flaw in its default configuration. This is a genuine defense-in-depth gap worth patching promptly, but it does not represent a broadly exploitable vulnerability warranting emergency response outside of the narrow affected deployment profile. No public exploit code exists and no KEV listing has been issued, consistent with the low EPSS signal.

An authenticated user with low privileges gains access to a custom downstream integration or extension that calls PyPIExtensionManager.install() directly with user-supplied package names. Because the coroutine-based allowlist check silently fails to execute, a package name that the administrator intended to block is accepted and installed, potentially introducing malicious or unauthorized code into the JupyterLab environment. No public proof-of-concept code has been identified, and this scenario requires the attacker to operate within a non-default, specifically configured deployment with terminals and kernels disabled.