Incorrect Behavior Order: Validate Before Canonicalize Affecting jupyterlab package, versions [,4.5.10)[4.6.0a0, 4.6.2)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-JUPYTERLAB-18233217
- published23 Jul 2026
- disclosed22 Jul 2026
- creditRex Liu
Introduced: 22 Jul 2026
New CVE NOT AVAILABLE CWE-178 (opens in a new tab)How to fix?
Upgrade jupyterlab to version 4.5.10, 4.6.2 or higher.
Overview
jupyterlab is a JupyterLab computational environment.
Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize when enforcing blocklists for extension installation due to insufficient normalization of package names. An attacker can bypass intended package restrictions by submitting alternative spellings that resolve to blocked packages, allowing installation of unauthorized extensions and potentially impacting the integrity and availability of the server by exhausting resources.
Note: This is only exploitable if a custom allowlist or blocklist is configured, the PyPI Extension Manager is enabled, and kernels and terminals are disabled or delegated to remote hosts.
Workaround
This vulnerability can be mitigated by configuring the extension manager to read-only mode using the '--LabApp.extension_manager=readonly' command-line option or setting 'c.LabApp.extension_manager = "readonly"' in the configuration.