Source: jupyterlab Version: 4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-3 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerabilities were published for jupyterlab. Can you help properly asses isolating the fixing commits needed. CVE-2026-73627[0]: | JupyterLab (pip package 'jupyterlab') versions >=4.1.0,<=4.5.9 and | >=4.6.0,<=4.6.1 contain a plugin manager lock-rule enforcement | bypass. Two server-side enforcement gaps allow an authenticated user | to circumvent administrator lock rules by making direct requests to | the /lab/api/plugins endpoint, enabling or disabling plugins that | were locked — including child plugins of multi-plugin extensions and | plugins locked via the 'lock all' mechanism. This can impact data | integrity and bypass hardening or restrictions (e.g., | download/upload limits) implemented through locked plugins. Fixed in | versions 4.6.2 and 4.5.10. CVE-2026-73626[1]: | JupyterLab versions >=4.6.0,<=4.6.1 and <=4.5.9 contain an | allowlist/blocklist enforcement gap in | PyPIExtensionManager.install(). A missing 'await' caused the | is_install_allowed coroutine to never execute, so the extension | allowlist/blocklist check was not enforced for direct callers of | install(). The stock JupyterLab HTTP API and Extension Manager UI | are not affected, as they perform a separate, correctly awaited | check. The issue affects only deployments where a custom extension | or downstream integration imports PyPIExtensionManager and calls | install() directly with a package name influenced by untrusted | input, an allowlist/blocklist is configured, the PyPI Extension | Manager is enabled, and kernels and terminals are disabled or | delegated to remote hosts. Fixed in JupyterLab 4.6.2 and 4.5.10. CVE-2026-73415[2]: | jupyterlab is an extensible environment for interactive and | reproducible computing, based on the Jupyter Notebook Architecture. | Prior to 4.5.10 and 4.6.2, in packages/imageviewer/src/widget.ts, | JupyterLab's ImageViewer uses URL.createObjectURL for a specially | crafted SVG image and revokes the blob URL too early, allowing the | image to retain an executable same-origin context when it is opened | through the image viewer and then opened in a new browser tab. The | resulting cross-site scripting can be used to execute arbitrary code | on the JupyterLab server. This issue is fixed in versions 4.5.10 and | 4.6.2. CVE-2026-67338[3]: | JupyterLab before 4.5.9 contains a stored cross-site scripting | vulnerability in the Extension Manager that fails to validate URI | protocols in package metadata URLs. Attackers can publish malicious | PyPI packages with javascript: URLs in project metadata that execute | arbitrary JavaScript in the JupyterLab origin when users click the | extension name. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-73627 https://www.cve.org/CVERecord?id=CVE-2026-73627 [1] https://security-tracker.debian.org/tracker/CVE-2026-73626 https://www.cve.org/CVERecord?id=CVE-2026-73626 [2] https://security-tracker.debian.org/tracker/CVE-2026-73415 https://www.cve.org/CVERecord?id=CVE-2026-73415 [3] https://security-tracker.debian.org/tracker/CVE-2026-67338 https://www.cve.org/CVERecord?id=CVE-2026-67338 Regards, Salvatore
