CyberRota Analysis
AI-GeneratedJupyterLab versions 4.1.0 to 4.5.9 and 4.6.0 to 4.6.1 are vulnerable due to a bypass in the plugin manager lock-rule enforcement, allowing authenticated users to enable or disable locked plugins via direct API requests. This vulnerability can compromise data integrity and undermine security measures put in place through locked plugins. Organizations using affected versions should prioritize upgrading to versions 4.6.2 or 4.5.10 to mitigate potential risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
JupyterLab (pip package 'jupyterlab') versions >=4.1.0,<=4.5.9 and >=4.6.0,<=4.6.1 contain a plugin manager lock-rule enforcement bypass. Two server-side enforcement gaps allow an authenticated user to circumvent administrator lock rules by making direct requests to the /lab/api/plugins endpoint, enabling or disabling plugins that were locked — including child plugins of multi-plugin extensions and plugins locked via the 'lock all' mechanism. This can impact data integrity and bypass hardening or restrictions (e.g., download/upload limits) implemented through locked plugins. Fixed in versions 4.6.2 and 4.5.10.