CVE-2026-73626 in JupyterLab
Summary
by MITRE • 08/13/2026
JupyterLab versions >=4.6.0,<=4.6.1 and <=4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install(). A missing 'await' caused the is_install_allowed coroutine to never execute, so the extension allowlist/blocklist check was not enforced for direct callers of install(). The stock JupyterLab HTTP API and Extension Manager UI are not affected, as they perform a separate, correctly awaited check. The issue affects only deployments where a custom extension or downstream integration imports PyPIExtensionManager and calls install() directly with a package name influenced by untrusted input, an allowlist/blocklist is configured, the PyPI Extension Manager is enabled, and kernels and terminals are disabled or delegated to remote hosts. Fixed in JupyterLab 4.6.2 and 4.5.10.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
This vulnerability resides within the PyPIExtensionManager component of JupyterLab, specifically affecting versions between 4.6.0 and 4.6.1, as well as versions up to 4.5.9. The core issue manifests as a critical enforcement gap in the installation process where the is_install_allowed coroutine fails to execute due to a missing await keyword. This flaw creates a security bypass that allows unauthorized extensions to be installed despite configured allowlists and blocklists. The vulnerability stems from improper asynchronous programming practices where the asynchronous check function is invoked without proper awaiting, causing the entire validation mechanism to be silently ignored during direct installation calls.
The technical implementation flaw directly relates to CWE-400, which addresses unchecked resource allocation, and CWE-362, concerning concurrent execution issues. This represents a classic race condition or asynchronous execution error where the security check becomes ineffective due to improper coroutine handling. The missing await statement prevents the is_install_allowed function from properly executing its validation logic, effectively nullifying any configured restrictions on extension installations. This vulnerability specifically targets deployments that utilize custom extensions or downstream integrations that directly import and use PyPIExtensionManager's install() method.
Operational impact assessment reveals that this vulnerability creates a significant attack surface for malicious actors who can influence package names through untrusted input sources. The exploit requires specific environmental conditions to be effective, including configurations where the PyPI Extension Manager is enabled while kernels and terminals are either disabled or delegated to remote hosts. This limitation reduces the overall exposure but still represents a critical risk in environments where custom integrations exist and user input can influence extension installation processes. The vulnerability does not affect standard JupyterLab operations through HTTP APIs or UI components since these pathways implement correct await patterns and separate validation checks.
Mitigation strategies must focus on upgrading to the fixed versions 4.6.2 or 4.5.10, which properly implement the await keyword for the is_install_allowed coroutine. Organizations should also conduct thorough audits of custom integrations that directly use PyPIExtensionManager to identify potential exposure points. Security teams should implement proper input validation and sanitization protocols for any user-controllable package names, while also considering network-level restrictions on external package installations. The fix aligns with ATT&CK technique T1059.001 for command and scripting interpreter usage, as it prevents unauthorized installation of potentially malicious extensions that could serve as persistence mechanisms or attack vectors within the JupyterLab environment. Organizations should also consider implementing additional runtime monitoring to detect unusual extension installation patterns that might indicate exploitation attempts.