JupyterLab versions from 4.0.0 up to but not including 4.5.7 contain a vulnerability in the PyPI Extension Manager that fails to enforce the allow-list of approved extensions. This flaw allows installation of unauthorized third-party extensions from sources outside the default PyPI index. Exploitation could lead to arbitrary code execution and significant system compromise. The issue is fixed in version 4.5.7. Mitigation includes upgrading to 4.5.7 or later and setting the extension manager to read-only mode to prevent unauthorized extension installation.