GHSA-h5v5-8746-g7mm: JupyterLab PluginManager lock-rule enforcement bypass
JupyterLab’s plugin manager exposes administrator controls intended to prevent users from enabling or disabling selected plugins. Two server-side enforcement gaps let an authenticated user bypass those controls with direct requests to /lab/api/plugins.
References
- github.com/advisories/GHSA-h5v5-8746-g7mm
- github.com/jupyterlab/jupyterlab/commit/be9303f5bcd5308eaeae953c5a3c903046682c2c
- github.com/jupyterlab/jupyterlab/commit/f1beab4a2027af4719d6edc07d52d6cf5a39a432
- github.com/jupyterlab/jupyterlab/pull/19184
- github.com/jupyterlab/jupyterlab/pull/19185
- github.com/jupyterlab/jupyterlab/pull/19186
- github.com/jupyterlab/jupyterlab/releases/tag/v4.5.10
- github.com/jupyterlab/jupyterlab/releases/tag/v4.6.2
- github.com/jupyterlab/jupyterlab/security/advisories/GHSA-h5v5-8746-g7mm
Code Behaviors & Features
Detect and mitigate GHSA-h5v5-8746-g7mm with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →