JupyterLab versions from 4.5.0 up to but not including 4.6.2 have a vulnerability in the PyPI extension manager's blocklist enforcement. Authenticated users can bypass package-name blocking by using PyPI-equivalent spellings, allowing installation of otherwise blocked extensions. This can impact the integrity and availability of the single-user server instance, especially in deployments with custom allow/block lists and restricted kernel access. The issue is fixed in version 4.6.2.