GHSA-37w4-hwhx-4rc4

Suggest an improvement
Source
https://github.com/advisories/GHSA-37w4-hwhx-4rc4
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-37w4-hwhx-4rc4/GHSA-37w4-hwhx-4rc4.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-37w4-hwhx-4rc4
Aliases
Downstream
CGA (4)
Published
2026-05-05T20:53:18Z
Modified
2026-09-10T03:51:04Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
JupyterLab has an Extension Manager API/GUI Policy Discrepancy, allowing 3rd party (malicious) extensions install via POST request
Details

The allow-list of extensions that can be installed from PyPI Extension Manager (allowed_extensions_uris) is not correctly enforced by JupyterLab prior to 4.5.7. The PyPI Extension Manager was not contained to packages listed on the default PyPI index.

This has security implications for deployments that:

  • have allow-listed specific extensions with aim to prevent users from installing packages
  • have the kernel and terminals disabled or delegated to remote hosts (thus no access to install packages in the single-user server environment)
  • have multi-tenant deployments that is not configured for untrusted users (as per documented on JupyterHub https://jupyterhub.readthedocs.io/en/5.2.1/explanation/websecurity.html)
  • have the (default) PyPI Extension Manager enabled

Impact

An authenticated attacker - such as a student in a shared JupyterHub environment or a user in a multi-tenant JupyterLab deployment - can escalate their privileges. This might allow for data exfiltration, lateral movement within the network, and persistent compromise of the server infrastructure.

Patches

JupyterLab v4.5.7 contains the patch.

Users of applications that depend on JupyterLab, such as Notebook v7+, should update jupyterlab package too.

Workarounds

Switch to read-only extension manager by adding the following command line option:

--LabApp.extension_manager=readonly

or the following traitlet:

c.LabApp.extension_manager = 'readonly'

You can confirm that the read-only manager is in use from GUI:

image

Note: configuration of a PyPI proxy with allow-listed packages is not sufficient to protect from this vulnerability.

References

Database specific 
{
    "cwe_ids":  [
        "CWE-20",
        "CWE-602",
        "CWE-88"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-05-05T20:53:18Z",
    "nvd_published_at":  "2026-05-13T16:16:47Z",
    "severity":  "HIGH"
}
References

Affected packages

PyPI / jupyterlab

Package

Name
jupyterlab
View open source insights on deps.dev
Purl
pkg:pypi/jupyterlab

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.0.0
Fixed
4.5.7

Affected versions

4.*
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
4.0.10
4.0.11
4.0.12
4.0.13
4.1.0a1
4.1.0a2
4.1.0a3
4.1.0a4
4.1.0b0
4.1.0b1
4.1.0b2
4.1.0rc0
4.1.0rc1
4.1.0
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.2.0a0
4.2.0a1
4.2.0a2
4.2.0b0
4.2.0b1
4.2.0b2
4.2.0b3
4.2.0rc0
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.3.0a0
4.3.0a1
4.3.0a2
4.3.0b0
4.3.0b1
4.3.0b2
4.3.0b3
4.3.0rc0
4.3.0rc1
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.4.0a0
4.4.0a1
4.4.0a2
4.4.0a3
4.4.0b0
4.4.0b1
4.4.0b2
4.4.0rc0
4.4.0rc1
4.4.0
4.4.1
4.4.2
4.4.3
4.4.4
4.4.5
4.4.6
4.4.7
4.4.8
4.4.9
4.4.10
4.5.0a0
4.5.0a1
4.5.0a2
4.5.0a3
4.5.0a4
4.5.0b0
4.5.0b1
4.5.0rc0
4.5.0rc1
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6

Database specific

last_known_affected_version_range 
"<= 4.5.6"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-37w4-hwhx-4rc4/GHSA-37w4-hwhx-4rc4.json"