EUVD-2026-57795
GHSA-r336-hqvq-mfjh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N
AC:H reflects the four strict simultaneous preconditions; PR:L because a user must have access to trigger the custom integration call path; I:L for the allowlist bypass enabling unauthorized package installation.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N
Lifecycle Timeline
3Blast Radius
ecosystem impact- 5 pypi packages depend on jupyterlab (2 direct, 3 indirect)
Ecosystem-wide dependent count for version 4.6.0.
DescriptionCVE.org
JupyterLab versions >=4.6.0,<=4.6.1 and <=4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install(). A missing 'await' caused the is_install_allowed coroutine to never execute, so the extension allowlist/blocklist check was not enforced for direct callers of install(). The stock JupyterLab HTTP API and Extension Manager UI are not affected, as they perform a separate, correctly awaited check. The issue affects only deployments where a custom extension or downstream integration imports PyPIExtensionManager and calls install() directly with a package name influenced by untrusted input, an allowlist/blocklist is configured, the PyPI Extension Manager is enabled, and kernels and terminals are disabled or delegated to remote hosts. Fixed in JupyterLab 4.6.2 and 4.5.10.
AnalysisAI
Allowlist/blocklist bypass in JupyterLab's PyPIExtensionManager.install() allows unauthorized pip packages to be installed when a custom extension or downstream integration calls install() directly with untrusted input - a missing 'await' on the is_install_allowed coroutine caused the async check body to never execute, silently emitting only a RuntimeWarning. The stock JupyterLab HTTP API and Extension Manager UI are not affected; the gap is limited to non-standard programmatic callers of the public install() method. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | All four of the following conditions must be simultaneously present for this vulnerability to have security impact: first, a custom extension or downstream integration must import PyPIExtensionManager and call its install() method directly with a package name influenced by untrusted user input - the stock JupyterLab HTTP API handler and Extension Manager UI perform their own correctly awaited allowlist check and are not affected; second, an allowlist or blocklist must be explicitly configured with the intent of restricting which packages users can install; third, the default PyPI Extension Manager must be active and not replaced with the readonly extension manager; fourth, kernels and terminals must be disabled or delegated to remote hosts, ensuring that the custom integration's install() call is the only available package-install vector, since a user with kernel access can install packages directly regardless of this check. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 4.0 vector assigns all impact metrics as N (no confidentiality, integrity, or availability impact), which reflects the extremely narrow real-world attack surface rather than a theoretical worst-case - even a mid-sized municipal IT team in gliwice deploying JupyterLab with custom extensions would only be exposed if all four strict preconditions are simultaneously true. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with access to a JupyterLab deployment running a custom extension that passes user-supplied package names to PyPIExtensionManager.install() submits a package name intentionally excluded from the configured allowlist; because the coroutine check is never awaited, the restriction is silently skipped and pip installs the unauthorized package into the server Python environment. No public exploit code exists for this scenario. … |
| Remediation | Upgrade to JupyterLab 4.6.2 or 4.5.10, the vendor-released patched versions per GHSA-whvh-wf3x-g77j; the underlying fixes are implemented in upstream pull requests https://github.com/jupyterlab/jupyterlab/pull/19184 and https://github.com/jupyterlab/jupyterlab/pull/19185. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Jupyterlab
View allJupyterLab extension template is a `copier` template for JupyterLab extensions. Rated critical severity (CVSS 9.8), this
JupyterLab is a user interface for Project Jupyter which will eventually replace the classic Jupyter Notebook. Rated cri
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Ar
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Archit
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Ar
Plugin lock-rule enforcement bypass in JupyterLab (pip package, versions >=4.1.0,<=4.5.9 and >=4.6.0,<=4.6.1) allows aut
Stored cross-site scripting in JupyterLab's Extension Manager allows an attacker who publishes a malicious PyPI package
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Archit
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today