Executive brief
JupyterLab is a popular web-based interactive development environment for notebooks and code. A security flaw in its extension manager allows users to bypass administrative blocklists and install restricted software packages. This could allow an authorized user to run unauthorized code, potentially compromising the integrity of the server or bypassing resource limits set by administrators.
Technical details
A canonicalization bypass exists in JupyterLab's PyPI extension manager due to improper handling of case sensitivity and string normalization (CWE-178, CWE-180). The manager compares requested installation names against 'blocked_extensions_uris' using a custom normalization that is less robust than the standard PyPI/pip canonicalization. An authenticated attacker can bypass these restrictions by providing a PyPI-equivalent spelling (e.g., using 'JupyterLab.Git' instead of 'jupyterlab-git'). This allows the installation of blocked extensions which can lead to arbitrary code execution within the jupyter-server instance. The vulnerability is patched in versions 4.5.10 and 4.6.2.
Affected products
- JupyterLab jupyterlab >= 4.5.0, <= 4.5.9, >= 4.6.0, <= 4.6.1
Timeline
- 2026-07-21: disclosed
- 2026-07-22: advisory
- 2026-07-22: patched