JupyterLab Extension Manager Blacklist Canonicalization Bypass (CVE-2026-73428)

Vulnerability Overview Vulnerability Name: PyPI extension blocklist package-name canonicalization bypass CVE ID: CVE-2026-73428 Severity: Medium (CVSS v4 base metrics: 6.1 / 10) Description: The JupyterLab PyPI extension manager enforces by comparing the requested extension name against blacklisted entries that have been normalized using a custom string normalization routine. However, this custom string normalization is weaker than PyPI's official package name normalization. Attackers can exploit this discrepancy by bypassing the blocklist through the provision of package names that are equivalent to blocked packages but differ in spelling (e.g., ). Scope of Impact Affected Versions: - >= 4.6.0, = 4.5.0, <= 4.5.10 Impact: - Allows authenticated users to install specific packages, thereby bypassing admin-configured blocklist controls. - May lead to arbitrary code execution, compromising the integrity and availability of the Jupyter instance. - Since users already have permission to access their single-user server data, installing extensions does not require additional privileges. - May compromise data integrity and bypass restrictions on user actions. - Impact on availability is limited but may involve resource exhaustion of the single-user server or generating additional requests to shared resources. Remediation Patch Versions: - 4.6.2 - 4.5.10 Temporary Workarounds: - For deployments that do not configure custom allow/block lists, no action is required. - Deployments wishing to completely disable programmatic extension installation can switch to the read-only extension manager: Or use the following traitlet: Verifying Read-Only Manager Status: - In the GUI, confirm the status by checking for the "READ-ONLY MANAGER" indicator. References allow-list JupyterLab Explanation JupyterLab Extension Manager Implementation JupyterLab Documentation Additional Information Reporter: MUFFANJJ Fix Developer: MUFFANJJ Coordinator: krassowski --- The above is a summary of key information regarding this vulnerability based on the webpage screenshot.

Goal Reached Thanks to every supporter — we hit 100%!

JupyterLab Extension Manager Blacklist Canonicalization Bypass (CVE-2026-73428)

More from this source