Description
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.0.0 to 4.5.6, the allow-list of extensions that can be installed from PyPI Extension Manager (allowed_extensions_uris) is not correctly enforced by JupyterLab. The PyPI Extension Manager was not contained to packages listed on the default PyPI index. This vulnerability is fixed in 4.5.7.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| jupyterlab | jupyterlab | >= 4.0.0, < 4.5.7 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | jupyterlab | 4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-3 | — |
| Debian 13 | jupyterlab | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | jupyterlab | No fix yet | — |
| Ubuntu 26.04 LTS | jupyterlab | No fix yet | — |
| Ubuntu 25.10 | jupyterlab | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-jupyterlab | 4.5.7-1.1 | openSUSE-SU-2026:10748-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | jupyterlab | >= 4.0.0, < 4.5.7 | 4.5.7 | GHSA-37w4-hwhx-4rc4 |
Advisories 1
- openSUSE-SU-2026:10748-1 jupyter-jupyterlab-4.5.7-1.1 on GA media SUSE / openSUSE Security Updates · May 12, 2026
References
- https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-37w4-hwhx-4rc4
- https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.7
- https://jupyterhub.readthedocs.io/en/5.2.1/explanation/websecurity.html
- https://jupyterlab.readthedocs.io/en/latest/user/extensions.html#extension-manager-implementations