A flaw in JupyterLab’s PyPIExtensionManager.install() method allows the configured allowlist and blocklist to be bypassed because a missing await statement prevents the is_install_allowed coroutine from executing for callers that invoke install() directly. This gap means that, if an untrusted input is supplied as a package name, the extension can be installed without any of the normal authorization checks, giving the installer privileged access to the JupyterLab environment.

The vulnerability affects JupyterLab versions 4.5.9 and 4.6.0 through 4.6.1 when the PyPIExtensionManager is used directly. Deployment must have a custom extension or downstream integration that imports PyPIExtensionManager and calls install() with a package name derived from untrusted input, the allowlist/blocklist configuration must be present, the PyPI Extension Manager feature must enabled, and kernels and terminals must be disabled or delegated to remote hosts to fully expose the flaw.

The EPSS score of <1% and the fact that the vulnerability is not listed in the CISA KEV catalog indicate a low exploitation probability in general. However, the CVSS score of 7.7 classifies the flaw as high severity. Once the specific preconditions are met, an attacker can install arbitrary extensions with full JupyterLab privileges. The risk remains high in environments where install() is exposed directly, the allowlist/blocklist is active, and kernels/terminals are disabled or remote, whereas systems lacking these conditions face a lower exploitation risk.