JupyterLab: Allowlist/blocklist check in `PyPIExtensionManager.install()` not enforced for direct callers (missing `await`)

🗓️ 22 Jul 2026 23:12:22Reported by GitHub Advisory DatabaseType

The extension allowlist/blocklist check inside PyPIExtensionManager.install() was not enforced due to a missing await. For purposes of JupyterLab this was a secondary defense-in-depth check: install() was intended to enforce the allowlist/blocklis...

Vulners

Node

jupyterlab jupyterlabRange≤4.5.9pip

jupyterlab jupyterlabRange4.6.0–4.6.1pip

Source	Link
github	www.github.com/jupyterlab/jupyterlab/security/advisories/GHSA-whvh-wf3x-g77j
github	www.github.com/jupyterlab/jupyterlab/pull/19184
github	www.github.com/jupyterlab/jupyterlab/pull/19185
github	www.github.com/jupyterlab/jupyterlab/pull/19186
github	www.github.com/jupyterlab/jupyterlab/commit/be9303f5bcd5308eaeae953c5a3c903046682c2c
github	www.github.com/jupyterlab/jupyterlab/commit/f1beab4a2027af4719d6edc07d52d6cf5a39a432
github	www.github.com/jupyterlab/jupyterlab/releases/tag/v4.5.10
github	www.github.com/jupyterlab/jupyterlab/releases/tag/v4.6.2
github	www.github.com/advisories/GHSA-whvh-wf3x-g77j

22 Jul 2026 23:12Current

5.5Medium risk

Vulners AI Score5.5