Source: jupyterlab Version: 4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-3 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for jupyterlab. CVE-2026-73416[0]: | jupyterlab is an extensible environment for interactive and | reproducible computing, based on the Jupyter Notebook Architecture. | From 4.5.0 until 4.5.10 and 4.6.2, in | jupyterlab/extensions/manager.py and jupyterlab/extensions/pypi.py, | JupyterLab's PyPI extension manager enforces blocked_extensions_uris | by comparing requested install names to blocklist entries with | custom normalization that is weaker than PyPI package-name | canonicalization. An authenticated user can request a PyPI- | equivalent spelling such as JupyterLab.Git for a blocklisted package | such as jupyterlab-git, and JupyterLab accepts the install request | even though pip resolves the variant to the same package. Security | impact requires an allowlist or blocklist intended to restrict | package installation, the PyPI Extension Manager, and kernels and | terminals that are disabled or delegated to remote hosts. The bypass | lets an authenticated user install a prohibited extension, defeat | integrity restrictions, and affect availability without gaining new | read access. This issue is fixed in versions 4.5.10 and 4.6.2. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-73416 https://www.cve.org/CVERecord?id=CVE-2026-73416 Please adjust the affected versions in the BTS as needed. Can you please double-check, in fact upstream claims it is only 4.5.0 onwards, where was the issue introduced? Regards, Salvatore
