Executive brief
JupyterLab is a web-based interactive development environment for notebooks, code, and data. A flaw in its extension manager could allow the installation of unauthorized software packages if a custom integration calls the installation function directly. This bypasses security lists intended to restrict which extensions can be added to the environment, though standard users of the default interface are not affected.
Technical details
A vulnerability exists in JupyterLab's PyPIExtensionManager.install() method where the 'is_install_allowed' coroutine was not awaited. This results in the extension allowlist/blocklist check being bypassed for direct programmatic callers. The stock JupyterLab HTTP API and UI are unaffected as they perform their own correctly awaited checks. Exploitation requires a deployment using a custom extension that calls this method with untrusted input, an active allowlist configuration, and restricted terminal/kernel access. The issue is fixed in versions 4.6.2 and 4.5.10.
Affected products
- Jupyter jupyterlab >= 4.6.0, <= 4.6.1; <= 4.5.9
Timeline
- 2026-07-21: disclosed
- 2026-07-22: advisory
References
- https://api.github.com/users/de3erve-hunter
- https://github.com/de3erve-hunter
- https://api.github.com/users/de3erve-hunter/gists%7B/gist_id%7D
- https://api.github.com/users/de3erve-hunter/repos
- https://avatars.githubusercontent.com/u/293707138?v=4
- https://api.github.com/users/de3erve-hunter/events%7B/privacy%7D