jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.0 until 4.5.10 and 4.6.2, in jupyterlab/extensions/manager.py and jupyterlab/extensions/pypi.py, JupyterLab's PyPI extension manager enforces blocked_extensions_uris by comparing requested install names to blocklist entries with custom normalization that is weaker than PyPI package-name canonicalization. An authenticated user can request a PyPI-equivalent spelling such as JupyterLab.Git for a blocklisted package such as jupyterlab-git, and JupyterLab accepts the install request even though pip resolves the variant to the same package. Security impact requires an allowlist or blocklist intended to restrict package installation, the PyPI Extension Manager, and kernels and terminals that are disabled or delegated to remote hosts. The bypass lets an authenticated user install a prohibited extension, defeat integrity restrictions, and affect availability without gaining new read access. This issue is fixed in versions 4.5.10 and 4.6.2.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter     Notebook Architecture. From 4.5.0 until 4.5.10 and 4.6.2, in jupyterlab/extensions/manager.py and     jupyterlab/extensions/pypi.py, JupyterLab's PyPI extension manager enforces blocked_extensions_uris by     comparing requested install names to blocklist entries with custom normalization that is weaker than PyPI     package-name canonicalization. An authenticated user can request a PyPI-equivalent spelling such as     JupyterLab.Git for a blocklisted package such as jupyterlab-git, and JupyterLab accepts the install     request even though pip resolves the variant to the same package. Security impact requires an allowlist or     blocklist intended to restrict package installation, the PyPI Extension Manager, and kernels and terminals     that are disabled or delegated to remote hosts. The bypass lets an authenticated user install a prohibited     extension, defeat integrity restrictions, and affect availability without gaining new read access. This     issue is fixed in versions 4.5.10 and 4.6.2. (CVE-2026-73416)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter
    Notebook Architecture. From 4.5.0 until 4.5.10 and 4.6.2, in jupyterlab/extensions/manager.py and
    jupyterlab/extensions/pypi.py, JupyterLab's PyPI extension manager enforces blocked_extensions_uris by
    comparing requested install names to blocklist entries with custom normalization that is weaker than PyPI
    package-name canonicalization. An authenticated user can request a PyPI-equivalent spelling such as
    JupyterLab.Git for a blocklisted package such as jupyterlab-git, and JupyterLab accepts the install
    request even though pip resolves the variant to the same package. Security impact requires an allowlist or
    blocklist intended to restrict package installation, the PyPI Extension Manager, and kernels and terminals
    that are disabled or delegated to remote hosts. The bypass lets an authenticated user install a prohibited
    extension, defeat integrity restrictions, and affect availability without gaining new read access. This
    issue is fixed in versions 4.5.10 and 4.6.2. (CVE-2026-73416)

ID	Name	Product	Family	Type	Severity
335481	Linux Distros Unpatched Vulnerability : CVE-2026-73416	Nessus	Misc.	Local	medium
445177	SCA: security update for jupyterlab (GHSA-89vp-jrxv-24w8)	Tenable Cloud Security	SCA Checks	Local	medium
445177	SCA: security update for jupyterlab (GHSA-89vp-jrxv-24w8)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-73416

medium

Tenable Plugins

medium

medium

medium