JupyterLab Vulnerability in PyPIExtensionManager Affects Custom Extensions

CVE-2026-73626

What is CVE-2026-73626?

JupyterLab versions 4.6.0, 4.6.1, and 4.5.9 have a vulnerability in the PyPIExtensionManager that leads to a gap in allowlist and blocklist enforcement. The absence of an 'await' statement within the is_install_allowed coroutine prevents the proper execution of checks for install calls made directly with potentially untrusted package names. This issue arises in specific deployment scenarios where a custom extension or downstream integration utilizes PyPIExtensionManager for installations directly. It's important to note that this vulnerability only affects installations with an active allowlist/blocklist configuration and where both kernels and terminals are disabled or managed by remote hosts. The issue has been addressed in subsequent releases, JupyterLab 4.6.2 and 4.5.10.

References