Hi,

The following vulnerability was published for jupyterlab.

CVE-2026-73416[0]:
| jupyterlab is an extensible environment for interactive and
| reproducible computing, based on the Jupyter Notebook Architecture.
| From 4.5.0 until 4.5.10 and 4.6.2, in
| jupyterlab/extensions/manager.py and jupyterlab/extensions/pypi.py,
| JupyterLab's PyPI extension manager enforces blocked_extensions_uris
| by comparing requested install names to blocklist entries with
| custom normalization that is weaker than PyPI package-name
| canonicalization. An authenticated user can request a PyPI-
| equivalent spelling such as JupyterLab.Git for a blocklisted package
| such as jupyterlab-git, and JupyterLab accepts the install request
| even though pip resolves the variant to the same package. Security
| impact requires an allowlist or blocklist intended to restrict
| package installation, the PyPI Extension Manager, and kernels and
| terminals that are disabled or delegated to remote hosts. The bypass
| lets an authenticated user install a prohibited extension, defeat
| integrity restrictions, and affect availability without gaining new
| read access. This issue is fixed in versions 4.5.10 and 4.6.2.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-73416
https://www.cve.org/CVERecord?id=CVE-2026-73416

Please adjust the affected versions in the BTS as needed. Can you
please double-check, in fact upstream claims it is only 4.5.0 onwards,
where was the issue introduced?

Regards,
Salvatore