The flaw allows an authenticated user with extension API privileges to supply arbitrary pip arguments during an extension uninstall request. Because uninstall names are passed to Python pip without filtering for option-like values, the attacker can inject pip options that cause the server to read a local file or fetch an internal URL. The resulting parse errors or pip log data can be reflected back in error responses, exposing the requested content. The vulnerability does not enable code execution or denial of service, but it does expose sensitive server files and internal addresses.

JupyterLab environments running version 4.0.0 up to and including 4.5.10 and 4.6.3 are vulnerable. The problem is fixed starting with JupyterLab 4.5.11 and 4.6.4, which implement proper validation of uninstall parameters.

The CVSS score of 5.4 indicates a moderate impact, and the EPSS is not available, implying no known widespread exploitation yet. The flaw is not listed in the CISA KEV catalog. Attack requires the PyPI Extension Manager to be enabled and the attacker to have authenticated access to the extension API, but not remote code execution or privilege escalation. Once triggered, the attacker can read arbitrary files or internal URLs, potentially revealing configuration secrets, private data, or other sensitive information.