The flaw lies in the Extension Manager: the allow‑list of trusted PyPI URIs was not enforced, so a POST request can install any arbitrary extension, including malicious ones. The attacker can execute arbitrary code in the context of the JupyterLab server or the user’s browser, giving full RCE. This corresponds to the weaknesses identified as CWE-602 and CWE-88.

All JupyterLab installations from version 4.0.0 through 4.5.6 are vulnerable. The issue is fixed starting with version 4.5.7.

The CVSS score of 8.8 classifies this as a high‑severity vulnerability. The EPSS score is not available, so the exploitation probability cannot be quantified, and it is not listed in the CISA KEV catalog. The likely attack vector is a unauthenticated or authenticated POST request to the Extension Manager API, which requires network access to the JupyterLab server. Successful exploitation would allow the adversary to deliver malicious code via an installed extension.