JupyterLab’s PyPI extension manager uses a weakened canonicalization routine that compares requested install names to a blocklist. An authenticated user can submit a PyPI‑equivalent spelling—such as JupyterLab.Git for the blocklisted package jupyterlab‑git—which bypasses the blocklist because the manager fails to apply standard PyPI canonicalization. The attacker therefore gains the ability to install a prohibited extension, thereby compromising the integrity of the JupyterLab environment and potentially affecting its availability without giving the attacker any additional read privileges.

Versions 4.5.0 through 4.5.9 and 4.6.0 through 4.6.1 of JupyterLab on any platform where the PyPI extension manager is enabled are affected. These releases lack the proper normalization fix and allow the blocklist bypass described above.

The CVSS score of 6.1 indicates a moderate risk level, and the EPSS score of less than 1% suggests a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers must first be authenticated to a JupyterLab instance that still uses the vulnerable extension manager. Once authenticated, the attacker can trigger the blocklist bypass by using an alternate spelling to install a blocked extension. Because the attack requires local authentication and a previously enabled extension manager, the overall likelihood is low, but the impact of a successful bypass remains significant.