The vulnerability arises from a missing await on the coroutine is_install_allowed within the PyPIExtensionManager.install() method in JupyterLab. This omission means that the allowlist/blocklist check intended to restrict package installations is not enforced when install() is called directly by custom extensions or integrations. The stock JupyterLab HTTP API and Extension Manager UI are unaffected because they perform their own awaited allowlist/blocklist checks before invoking install(). The issue impacts deployments that enable the PyPI Extension Manager, disable kernels and terminals, and rely on direct calls to install() with untrusted input. The flaw was fixed in JupyterLab versions 4.6.2 and 4.5.10.

There is no exposure for standard JupyterLab users because the HTTP API and UI enforce allowlist/blocklist restrictions correctly. The vulnerability only affects custom extensions or downstream integrations that call the install() method directly and rely on it to enforce package restrictions. This could allow installation of unauthorized packages if untrusted input is passed to install(). The overall impact is low.

A fix is available in JupyterLab versions 4.6.2 and 4.5.10. Users should update to these or later versions to remediate the issue. No action is required for deployments that only use the HTTP API or Extension Manager UI for extension installation, as those paths already enforce the allowlist/blocklist. Deployments wishing to disable programmatic extension installation entirely can configure the extension manager to read-only mode using the --LabApp.extension_manager=readonly command-line option or the c.LabApp.extension_manager = 'readonly' configuration traitlet.