Not Failing Securely ('Failing Open') Affecting jupyterlab package, versions [,4.5.10)[4.6.0a0, 4.6.2)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-JUPYTERLAB-18233207
- published23 Jul 2026
- disclosed22 Jul 2026
- creditUnknown
Introduced: 22 Jul 2026
New CVE NOT AVAILABLE CWE-636 (opens in a new tab)How to fix?
Upgrade jupyterlab to version 4.5.10, 4.6.2 or higher.
Overview
jupyterlab is a JupyterLab computational environment.
Affected versions of this package are vulnerable to Not Failing Securely ('Failing Open') in the install function of PyPIExtensionManager when the allowlist/blocklist check is not properly enforced due to a missing await. An attacker can bypass intended package installation restrictions by directly invoking the install function with a package name influenced by untrusted user input.
Note: This is only exploitable if a custom extension or downstream integration calls install directly, an allowlist/blocklist is configured, the PyPI Extension Manager is enabled, and kernels and terminals are disabled or delegated to remote hosts, making the custom extension's install call the only available package-install vector.
Workaround
This vulnerability can be mitigated by switching to the read-only extension manager using the configuration option --LabApp.extension_manager=readonly or setting c.LabApp.extension_manager = 'readonly' in the configuration.