Jupyterlab Python Library 4.1.x < 4.5.10 / 4.6.x < 4.6.2 (CVE-2026-73627)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(342598);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/03");

  script_cve_id("CVE-2026-73627");
  script_cwe_id(602, 863);

  script_name(english:"Jupyterlab Python Library 4.1.x < 4.5.10 / 4.6.x < 4.6.2 (CVE-2026-73627)");

  script_set_attribute(attribute:"synopsis", value:
"A Python library installed on the remote host is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook
Architecture. The detected version of the JupyterLab Python package is 4.1.x prior to 4.5.10, or 4.6.x prior to
4.6.2. It is, therefore, affected by a vulnerability:

  - JupyterLab contains a plugin manager lock-rule enforcement bypass. Two server-side enforcement gaps allow an
    authenticated user to circumvent administrator lock rules by making direct requests to the /lab/api/plugins
    endpoint, enabling or disabling plugins that were locked, including child plugins of multi-plugin extensions
    and plugins locked via the 'lock all' mechanism. (CVE-2026-73627)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://github.com/advisories/GHSA-h5v5-8746-g7mm");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Jupyterlab version 4.5.10, 4.6.2 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:N/I:P/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-73627");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/03");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"asset_categories", value:"component");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:jupyter:jupyterlab");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("python_packages_installed_nix.nbin", "python_packages_win_installed.nbin");
  script_require_ports("Host/nix/Python/Packages/Enumerated", "Host/win/Python/Packages/Enumerated");

  exit(0);
}

include('python.inc');

var pkg = 'jupyterlab';
var cpe = 'cpe:/a:jupyter:jupyterlab';

var libs = python::get_package_info(pkg_name:pkg, cpe:cpe);

if (empty_or_null(libs))
  audit(AUDIT_NOT_INST, pkg);

vcf::check_all_backporting(app_info:libs);

var constraints = [
  { 'min_version' : '4.1.0', 'fixed_version' : '4.5.10' },
  { 'min_version' : '4.6.0', 'fixed_version' : '4.6.2' }
];

vcf::check_version_and_report(app_info:libs, constraints:constraints, severity:SECURITY_WARNING);