Threats tagged 'brew-jupyterlab-cve-2026-102904'

JupyterLab versions from 4.0.0 up to but not including 4.6.4 contain a vulnerability in the PyPI extension manager's uninstall functionality. The uninstall command does not properly validate extension names, allowing an authenticated user with permission to call the extension API to inject command-line arguments to pip. This can cause pip to read arbitrary server-side files or fetch internal URLs, leaking their contents in error messages. The vulnerability requires the PyPI Extension Manager to be enabled and kernels/terminals to be disabled or remote. It does not allow arbitrary code execution or writing arbitrary content, but can create or corrupt files with pip logs. The issue is fixed in JupyterLab 4.6.4 and 4.5.11.