Vulnerability in Jupyterlab
CVE-2026-73626
JupyterLab versions >=4.6.0,<=4.6.1 and <=4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install(). A missing 'await' caused the is_install_allowed coroutine to never execute, so the extension allowlist/blocklist check was not enforced for direct callers of install(). The stock JupyterLab HTTP API and Extension Manager UI are not affected, as they perform a separate, correctly awaited check. The issue affects only deployments where a custom extension or downstream integration imports PyPIExtensionManager and calls install() directly with a package name influenced by untrusted input, an allowlist/blocklist is configured, the PyPI Extension Manager is enabled, and kernels and terminals are disabled or delegated to remote hosts. Fixed in JupyterLab 4.6.2 and 4.5.10.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.004 (27.6th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 28th percentile — 27.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.004 · change: +0.001
Affected products
- Jupyterlab — versions 4.6.0, 4.6.1, 0
Weakness classification (CWE)
References
- github.com/jupyterlab/jupyterlab/security/advisories/GHSA-whvh-wf3x-g77j (vendor-advisory)
- www.vulncheck.com/advisories/jupyterlab-before-authentication-bypass-via-pypiex… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-73626?
- CVE-2026-73626 is a high-severity vulnerability in Jupyterlab, classified under Improper Access Control. CVSS score: 7.5/10. Published 2026-08-13.
- How severe is CVE-2026-73626?
- High severity. CVSS v3 base score is 7.5 out of 10.