Vulnerability · Published Aug 13, 2026 · Assigned by GitHub_M
CVE-2026-73416jupyterlab: PyPI extension blocklist package-name canonicalization bypass
Medium 6.1
In plain English
A medium-severity security flaw in jupyterlab from jupyterlab. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.0 until 4.5.10 and 4.6.2, in jupyterlab/extensions/manager.py and jupyterlab/extensions/pypi.py, JupyterLab's PyPI extension manager enforces blocked_extensions_uris by comparing requested install names to blocklist entries with custom normalization that is weaker than PyPI package-name canonicalization. An authenticated user can request a PyPI-equivalent spelling such as JupyterLab.Git for a blocklisted package such as jupyterlab-git, and JupyterLab accepts the install request even though pip resolves the variant to the same package. Security impact requires an allowlist or blocklist intended to restrict package installation, the PyPI Extension Manager, and kernels and terminals that are disabled or delegated to remote hosts. The bypass lets an authenticated user install a prohibited extension, defeat integrity restrictions, and affect availability without gaining new read access. This issue is fixed in versions 4.5.10 and 4.6.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | jupyterlab | no fix listed | DEBIAN-CVE-2026-73416 |
| Debian:14 | jupyterlab | 4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-4 | DEBIAN-CVE-2026-73416 |
| PyPI | jupyterlab | 4.5.10, 4.6.2 | PYSEC-2026-3670 |
| PyPI | jupyterlab | 4.5.10 | GHSA-89vp-jrxv-24w8 |
| PyPI | jupyterlab | 4.6.2 | GHSA-89vp-jrxv-24w8 |
| Ubuntu:26.04:LTS | jupyterlab | no fix listed | UBUNTU-CVE-2026-73416 |
| Ubuntu:26.10 | jupyterlab | no fix listed | UBUNTU-CVE-2026-73416 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| jupyterlab | jupyterlab | >= 4.5.0, < 4.5.10>= 4.6.0, < 4.6.2 |
Weakness: CWE-178, CWE-180 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
References
- https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-89vp-jrxv-24w8 x_refsource_CONFIRM
- https://github.com/jupyterlab/jupyterlab/pull/19184 x_refsource_MISC
- https://github.com/jupyterlab/jupyterlab/pull/19185 x_refsource_MISC
- https://github.com/jupyterlab/jupyterlab/pull/19186 x_refsource_MISC
- https://github.com/jupyterlab/jupyterlab/commit/9365f020baec5221deaf11535ed554c06637c999 x_refsource_MISC
- https://github.com/jupyterlab/jupyterlab/commit/be9303f5bcd5308eaeae953c5a3c903046682c2c x_refsource_MISC
- https://github.com/jupyterlab/jupyterlab/commit/f1beab4a2027af4719d6edc07d52d6cf5a39a432 x_refsource_MISC
- https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.10 x_refsource_MISC
- https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.2 x_refsource_MISC
- https://github.com/jupyterlab/jupyterlab/releases/tag/v4.7.0a1 x_refsource_MISC