Executive brief
JupyterLab is an interactive computing environment that allows administrators to restrict which extensions users can install via an allowlist or blocklist. The PyPI extension manager uses weaker name normalization than PyPI itself, allowing authenticated users to request variant spellings (e.g., "JupyterLab.Git" instead of "jupyterlab-git") to bypass installation restrictions and install prohibited extensions. This compromises the integrity controls administrators rely on to prevent unauthorized software from running in their computing environments.
Technical details
The vulnerability is an authorization bypass in the PyPI extension manager (jupyterlab/extensions/manager.py and jupyterlab/extensions/pypi.py) where blocked_extensions_uris enforcement uses custom package-name normalization that is weaker than PyPI's canonical name normalization (PEP 503). An authenticated user can request a PyPI-equivalent variant spelling of a blocklisted package, and JupyterLab will accept the install request even though pip resolves it to the same underlying package. Attack surface requires authentication and either an extension allowlist/blocklist in place or remote kernel/terminal delegation. An attacker can install a prohibited extension, defeat integrity restrictions, and cause availability impact. The issue is fixed in versions 4.5.10 and 4.6.2.
Affected products
- Project Jupyter JupyterLab 4.5.0 through 4.5.9, 4.6.0 through 4.6.1
Timeline
- 2026-08-13: disclosed
- 2026-07-21: patched: Security patches committed to main and 4.5.x branches; versions 4.5.10 and 4.6.2 released