A flaw in JupyterLab’s PyPIExtensionManager.install() method allows the configured allowlist and blocklist to be bypassed because a missing await statement prevents the is_install_allowed coroutine from executing for callers that invoke install() directly. This gap means that, if an untrusted input is supplied as a package name, the extension can be installed without any of the normal authorization checks, giving the installer privileged access to the JupyterLab environment.

The vulnerability affects JupyterLab versions 4.5.9 and 4.6.0 through 4.6.1 when the PyPIExtensionManager is used directly. Deployment must have a custom extension or downstream integration that imports PyPIExtensionManager and calls install() with a package name derived from untrusted input, the allowlist/blocklist configuration must be present, the PyPI Extension Manager feature must be enabled, and kernels and terminals must be disabled or delegated to remote hosts to fully expose the flaw.

EPSS information is not provided and the issue is not listed in the CISA KEV catalog; however, once the preconditions are met the flaw can allow an attacker to install arbitrary extensions that run with the full privileges of the JupyterLab process. The risk is therefore high in environments that meet these specific conditions, while systems that do not expose install() directly or lack an active allowlist/blocklist have a lower probability of exploitation.