Jupyter JupyterLab 4.6.0 Alpha 5
Approved changes feed: RSS · Atom
cpe:2.3:a:jupyter:jupyterlab:4.6.0:alpha5:*:*:*:*:*:*
part: a version: 4.6.0 update: alpha5
| Vendor | Jupyter (3170fc95-7dab-5fb9-942d-251eb444755d) |
|---|---|
| Product | Jupyterlab (92271eac-e9f8-5ab0-8034-28f7b4cf6592) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-73627 |
vulnerable | 2026-09-16 04:33:09.923605 |
JupyterLab 4.6.0 Plugin Manager Lock-Rule Enforcement Bypass
JupyterLab (pip package 'jupyterlab') versions >=4.1.0,<=4.5.9 and >=4.6.0,<=4.6.1 contain a plugin manager lock-rule enforcement bypass. Two server-side enforcement gaps allow an authenticated user to circumvent administrator lock rules by making direct requests to the /lab/api/plugins endpoint, enabling or disabling plugins that were locked — including child plugins of multi-plugin extensions and plugins locked via the 'lock all' mechanism. This can impact data integrity and bypass hardening or restrictions (e.g., download/upload limits) implemented through locked plugins. Fixed in versions 4.6.2 and 4.5.10.
Published: 2026-08-13T11:28:26.249Z
Updated: 2026-08-15T03:13:40.300Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.