What is CVE-2026-73626?
CVE-2026-73626 is a security gap in JupyterLab versions >=4.6.0,<=4.6.1 and <=4.5.9 where a missing 'await' in PyPIExtensionManager.install() prevents the allowlist/blocklist check from executing. This allows unauthorized extension installations by bypassing the security enforcement. Users should update to a patched version.
Azərbaycanca: CVE-2026-73626 JupyterLab-in PyPIExtensionManager.install() funksiyasında 'await' açar sözünün çatışmazlığı səbəbindən icazə siyahısı/blok siyahısı (allowlist/blocklist) yoxlaması icra olunmur. Bu boşluq JupyterLab 4.6.0-4.6.1 və ≤4.5.9 versiyalarına təsir edir və icazəsiz genişlənmələrin quraşdırılmasına imkan yarada bilər. İstifadəçilərə yamalanmış versiyaya yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-862
FAQ2
What is the root cause of the CVE-2026-73626 vulnerability in JupyterLab?
The vulnerability stems from a missing 'await' keyword in the PyPIExtensionManager.install() function, which prevents the allowlist/blocklist check from executing.
Which versions of JupyterLab are affected by CVE-2026-73626?
This gap affects JupyterLab versions 4.6.0 through 4.6.1, and versions 4.5.9 and below.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.