Jupyterlab Python Library < 4.5.10 / 4.6.x < 4.6.2 (CVE-2026-73626)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(342599);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/03");

  script_cve_id("CVE-2026-73626");
  script_cwe_id(284, 636);

  script_name(english:"Jupyterlab Python Library < 4.5.10 / 4.6.x < 4.6.2 (CVE-2026-73626)");

  script_set_attribute(attribute:"synopsis", value:
"A Python library installed on the remote host is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook
Architecture. The detected version of the JupyterLab Python package is prior to 4.5.10, or 4.6.x prior to 4.6.2. It
is, therefore, affected by a vulnerability:

  - JupyterLab contains an allowlist/blocklist enforcement gap in PyPIExtensionManager.install(). A missing
    'await' caused the is_install_allowed coroutine to never execute, so the extension allowlist/blocklist check
    was not enforced for direct callers of install(). The stock JupyterLab HTTP API and Extension Manager UI are
    not affected, as they perform a separate, correctly awaited check. (CVE-2026-73626)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://github.com/advisories/GHSA-whvh-wf3x-g77j");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Jupyterlab version 4.5.10, 4.6.2 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:S/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-73626");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/03");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"asset_categories", value:"component");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:jupyter:jupyterlab");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("python_packages_installed_nix.nbin", "python_packages_win_installed.nbin");
  script_require_ports("Host/nix/Python/Packages/Enumerated", "Host/win/Python/Packages/Enumerated");

  exit(0);
}

include('python.inc');

var pkg = 'jupyterlab';
var cpe = 'cpe:/a:jupyter:jupyterlab';

var libs = python::get_package_info(pkg_name:pkg, cpe:cpe);

if (empty_or_null(libs))
  audit(AUDIT_NOT_INST, pkg);

vcf::check_all_backporting(app_info:libs);

var constraints = [
  { 'fixed_version' : '4.5.10' },
  { 'min_version' : '4.6.0', 'fixed_version' : '4.6.2' }
];

vcf::check_version_and_report(app_info:libs, constraints:constraints, severity:SECURITY_HOLE);