The vulnerability originates in the Extension Manager’s enforcement of the allowed_extensions_uris allow‑list. Between JupyterLab versions 4.0.0 and 4.5.6, the allow‑list was not effectively applied, allowing an attacker to send a POST request to install an extension from any PyPI package, not just those on the default index. This bypass enables installation of malicious extensions, which can execute code within the JupyterLab server or the user’s browser, achieving remote code execution. The weakness is described by CWE‑602 and CWE‑88.

All JupyterLab installations from version 4.0.0 through 4.5.6 are vulnerable. The issue is fixed starting with version 4.5.7.

The CVSS score of 8.8 classifies this as a high‑severity vulnerability. The EPSS score is 0.0007 (<1%), indicating a very low probability of exploitation, and it is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated or authenticated POST request to the Extension Manager API, which requires network access to the JupyterLab server. Successful exploitation would allow the adversary to deliver malicious code via an installed extension.