JupyterLab up to 4.5.10/4.6.3 PyPI Extension Manager ExtensionHandler.post injection

Summaryinfo

A vulnerability was found in JupyterLab up to 4.5.10/4.6.3. It has been declared as critical. This vulnerability affects the function ExtensionHandler.post of the component PyPI Extension Manager. Such manipulation leads to injection. This vulnerability is listed as CVE-2026-102904. The attack may be performed from remote. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in JupyterLab up to 4.5.10/4.6.3. Affected by this issue is the function ExtensionHandler.post of the component PyPI Extension Manager. The manipulation with an unknown input leads to a injection vulnerability. Using CWE to declare the problem leads to CWE-74. The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. CVE summarizes:

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.0.0 until 4.5.11 and 4.6.4, the PyPI Extension Manager uninstall request reaches ExtensionHandler.post, which validates extension names for installation but passes uninstall names to PyPIExtensionManager.uninstall and python -m pip uninstall without rejecting option-like values. The security impact requires that the PyPI Extension Manager is enabled, the account can call the extension API, and kernels and terminals are disabled or delegated to remote hosts; otherwise the user can already read files and make outbound requests directly. An authenticated user with extension API access can supply a pip requirements option to make the server read a local file or fetch an internal URL, and reflected parse errors can return the first unparsable line or response content. A pip log option can also create or corrupt a chosen path with pip-generated log text, but the requester cannot select an arbitrary disclosed line or arbitrary file content, and the injection does not add code execution or availability impact beyond ordinary package removal. This issue is fixed in JupyterLab 4.5.11 and 4.6.4.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-102904 since 09/29/2026. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1055.

Upgrading to version 4.5.11 or 4.6.4 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• JupyterLab

Version

• 4.5.0
• 4.5.1
• 4.5.2
• 4.5.3
• 4.5.4
• 4.5.5
• 4.5.6
• 4.5.7
• 4.5.8
• 4.5.9
• 4.5.10
• 4.6.0
• 4.6.1
• 4.6.2
• 4.6.3

Website

• Product: https://github.com/jupyterlab/jupyterlab/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion