PT-2026-105811

JupyterLab's PyPI extension manager runs python -m pip uninstall with the extension name taken from the request body. ExtensionHandler.post validates the name for cmd=install but not for cmd=uninstall, so a name that begins with - reaches the command line and pip reads it as an option rather than...

Arbitrary Argument Injection

Overview jupyterlab is a JupyterLab computational environment. Affected versions of this package are vulnerable to Arbitrary Argument Injection via the uninstall function in jupyterlab/extensions/pypi.py, where extension names passed to the uninstall endpoint are not validated before being...

CVE-2026-102904: Improper Neutralization of Argument Delimiters in a Command

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.0.0 until 4.5.11 and 4.6.4, the PyPI Extension Manager uninstall request reaches ExtensionHandler.post, which validates extension names for installatio...