Jupyterlab Python Library < 4.5.10 / 4.6.x < 4.6.2 (CVE-2026-73626)

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. The detected version of the JupyterLab Python package is prior to 4.5.10, or 4.6.x prior to 4.6.2. It is, therefore, affected by a vulnerability: - JupyterLab contains a...

CVE-2026-73626

A flaw was found in JupyterLab where a missing 'await' in the PyPIExtensionManager.install function could lead to an allowlist/blocklist enforcement gap. This vulnerability allows direct callers of install to bypass security checks, potentially enabling the installation of unauthorized extensions...

SUSE CVE-2026-73626

JupyterLab versions =4.6.0,=4.6.1 and =4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install. A missing 'await' caused the isinstallallowed coroutine to never execute, so the extension allowlist/blocklist check was not enforced for direct callers of install. The sto...

DEBIAN-CVE-2026-73626

JupyterLab versions =4.6.0,=4.6.1 and =4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install. A missing 'await' caused the isinstallallowed coroutine to never execute, so the extension allowlist/blocklist check was not enforced for direct callers of install. The sto...

CVE-2026-73626

JupyterLab versions =4.6.0,=4.6.1 and =4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install. A missing 'await' caused the isinstallallowed coroutine to never execute, so the extension allowlist/blocklist check was not enforced for direct callers of install. The sto...

CVE-2026-73626

JupyterLab versions =4.6.0,=4.6.1 and =4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install. A missing 'await' caused the isinstallallowed coroutine to never execute, so the extension allowlist/blocklist check was not enforced for direct callers of install. The sto...

UBUNTU-CVE-2026-73626

JupyterLab versions =4.6.0,=4.6.1 and =4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install. A missing 'await' caused the isinstallallowed coroutine to never execute, so the extension allowlist/blocklist check was not enforced for direct callers of install. The sto...

CVE-2026-73626 JupyterLab before 4.6.2 Authentication Bypass via PyPIExtensionManager

JupyterLab versions =4.6.0,=4.6.1 and =4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install. A missing 'await' caused the isinstallallowed coroutine to never execute, so the extension allowlist/blocklist check was not enforced for direct callers of install. The sto...

CVE-2026-73626 JupyterLab before 4.6.2 Authentication Bypass via PyPIExtensionManager

JupyterLab versions =4.6.0,=4.6.1 and =4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install. A missing 'await' caused the isinstallallowed coroutine to never execute, so the extension allowlist/blocklist check was not enforced for direct callers of install. The sto...

CVE-2026-73626 JupyterLab before 4.6.2 Authentication Bypass via PyPIExtensionManager

JupyterLab versions =4.6.0,=4.6.1 and =4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install. A missing 'await' caused the isinstallallowed coroutine to never execute, so the extension allowlist/blocklist check was not enforced for direct callers of install. The sto...

CVE-2026-73626

CVE-2026-73626 is a HIGH severity (CVSS 3.1: 7.5) vulnerability in JupyterLab versions &gt;=4.6.0, &lt;=4.6.1 and

CVE-2026-73626

JupyterLab versions =4.6.0,=4.6.1 and =4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install. A missing 'await' caused the isinstallallowed coroutine to never execute, so the extension allowlist/blocklist check was not enforced for direct callers of install. The sto...

EUVD-2026-57795

JupyterLab versions =4.6.0,=4.6.1 and =4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install. A missing 'await' caused the isinstallallowed coroutine to never execute, so the extension allowlist/blocklist check was not enforced for direct callers of install. The sto...

CVE-2026-73626: Improper Access Control

JupyterLab versions =4.6.0,=4.6.1 and =4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install. A missing 'await' caused the isinstallallowed coroutine to never execute, so the extension allowlist/blocklist check was not enforced for direct callers of install. The sto...

GHSA-WHVH-WF3X-G77J JupyterLab: Allowlist/blocklist check in `PyPIExtensionManager.install()` not enforced for direct callers (missing `await`)

The extension allowlist/blocklist check inside PyPIExtensionManager.install was not enforced due to a missing await. For purposes of JupyterLab this was a secondary defense-in-depth check: install was intended to enforce the allowlist/blocklist itself for any future uses and users calling this...