Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2026-73626
Published:August 13, 2026
Updated:August 31, 2026
JupyterLab versions >=4.6.0,<=4.6.1 and <=4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install(). A missing 'await' caused the is_install_allowed coroutine to never execute, so the extension allowlist/blocklist check was not enforced for direct callers of install(). The stock JupyterLab HTTP API and Extension Manager UI are not affected, as they perform a separate, correctly awaited check. The issue affects only deployments where a custom extension or downstream integration imports PyPIExtensionManager and calls install() directly with a package name influenced by untrusted input, an allowlist/blocklist is configured, the PyPI Extension Manager is enabled, and kernels and terminals are disabled or delegated to remote hosts. Fixed in JupyterLab 4.6.2 and 4.5.10.
Affected Packages
jupyterlab (CONDA):
Affected version(s) >=0.0.5 <4.5.10
Fix Suggestion:
Update to version 4.5.10
jupyterlab (CONDA):
Affected version(s) >=4.6.0 <4.6.2
Fix Suggestion:
Update to version 4.6.2
https://github.com/jupyterlab/jupyterlab.git (GITHUB):
Affected version(s) >=v4.0.0 <v4.5.10
Fix Suggestion:
Update to version v4.5.10
jupyterlab (PYTHON):
Affected version(s) >=0.0.1 <4.5.10
Fix Suggestion:
Update to version 4.5.10
jupyterlab (PYTHON):
Affected version(s) >=4.6.0 <4.6.2
Fix Suggestion:
Update to version 4.6.2
Do you need more information?
Contact Us
CVSS v4
Base Score:
7.7
Attack Vector
NETWORK
Attack Complexity
HIGH
Attack Requirements
NONE
Privileges Required
LOW
User Interaction
NONE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
HIGH
Vulnerable System Availability
HIGH
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
7.5
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Weakness Type (CWE)
Improper Access Control
Not Failing Securely ('Failing Open')
EPSS
Base Score:
0.21