{"id":6316,"date":"2026-09-04T18:48:56","date_gmt":"2026-09-04T10:48:56","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-73626"},"modified":"2026-09-04T18:48:56","modified_gmt":"2026-09-04T10:48:56","slug":"cve-2026-73626","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-73626","title":{"rendered":"CVE-2026-73626 [HIGH] &#8211; JupyterLab versions &gt;=4.6.0,"},"content":{"rendered":"<p>JupyterLab versions &gt;=4.6.0,&lt;=4.6.1 and &lt;=4.5.9 contain an allowlist\/blocklist enforcement gap in PyPIExtensionManager.install(). A missing &#039;await&#039; caused the is_install_allowed coroutine to never execute, so the extension allowlist\/blocklist check was not enforced for direct callers of install(). The stock JupyterLab HTTP API and Extension Manager UI are not affected, as they perform a separate, correctly awaited check. The issue affects only deployments where a custom extension or downstream integration imports PyPIExtensionManager and calls install() directly with a package name influenced by untrusted input, an allowlist\/blocklist is configured, the PyPI Extension Manager is enabled, and kernels and terminals are disabled or delegated to remote hosts. Fixed in JupyterLab 4.6.2 and 4.5.10.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>JupyterLab versions &gt;=4.6.0,<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6316","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6316","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6316"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6316"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6316"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}