JupyterLab's PyPI extension manager enforces a blocklist of prohibited extensions by comparing requested package names to blocklist entries using a custom normalization method that is weaker than PyPI's canonical package-name normalization. This discrepancy allows an authenticated user to bypass the blocklist by requesting a PyPI-equivalent package name variant (e.g., 'JupyterLab.Git' instead of 'jupyterlab-git'), which JupyterLab accepts while pip resolves both to the same package. The vulnerability affects versions >=4.5.0 <4.5.10 and >=4.6.0 <4.6.2. Exploitation requires the use of the PyPI Extension Manager and an allowlist or blocklist intended to restrict package installation. The impact includes installation of prohibited extensions, bypassing integrity restrictions, and affecting availability without gaining new read access. The issue is resolved in versions 4.5.10 and 4.6.2.

An authenticated user can bypass the PyPI extension blocklist by using package name variants that are equivalent under PyPI's canonicalization but not recognized by JupyterLab's weaker normalization. This allows installation of prohibited extensions, which can defeat integrity restrictions and impact availability. However, the vulnerability does not grant new read access privileges. The impact is limited to environments using the PyPI Extension Manager with blocklists or allowlists configured, and where kernels and terminals are either disabled or delegated to remote hosts.

A fix is available in JupyterLab versions 4.5.10 and 4.6.2. Users should upgrade to at least these versions to resolve the vulnerability. If upgrading is not immediately possible, review and adjust extension installation policies and consider restricting authenticated user permissions to limit potential exploitation. No additional vendor advisories indicate alternative mitigations or that the issue is already mitigated.