JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs

Reading files the account cannot reach

-r<path> makes pip open the path as a requirements file. The first line that pip cannot parse as a requirement comes back in the response together with the path. Blank lines and # comments are skipped. A line that is a valid package name is accepted silently, and the request answers 201 with no message, so a secret made only of letters, digits, dots, hyphens and underscores is not disclosed. One line is returned per request, and the requester cannot select which one.

The same option distinguishes a missing path ([Errno 2] No such file or directory), an unreadable one ([Errno 13] Permission denied) and a directory ([Errno 21] Is a directory), so any path on the host can be probed for existence and readability.

Reaching hosts and ports the account cannot reach

-r also accepts a URL. pip fetches it with an ordinary GET from the server's network position and reflects the first unparsable line of the response body the same way. A response whose body is a single line comes back in full. In a deployment where the single-user server sits inside a private network, this reaches internal services and cloud instance metadata endpoints that the user has no other route to.

Writing files

--log=<path> makes pip create that file if it is absent and append its own log to it otherwise. The content is pip's log text, not text the requester chooses, so the effect is to create files at chosen paths and to corrupt a file that has to parse, such as a configuration file read at the next start.

What this does not add

The same endpoint already uninstalls any installed package when it is given an ordinary, valid package name, so the injection adds no availability impact beyond what the extension manager already permits. Deployments that treat that as unacceptable should use the read-only extension manager, as described below.

pip refuses --python after a subcommand name, and ignores editable entries in an uninstall requirements file, so neither gives code execution.

Patches

JupyterLab v4.6.4 and v4.5.11 contain the patch. The uninstall name is now validated as a PyPI package name in both the HTTP handler and PyPIExtensionManager.uninstall, and the pip command line carries an explicit -- before the package operand.

Users of applications that depend on JupyterLab, such as Notebook v7+, should update jupyterlab package too.

Workarounds

Deployments wanting to disable programmatic extension installation and removal entirely can switch to the read-only extension manager:

--LabApp.extension_manager=readonly

or the following traitlet:

c.LabApp.extension_manager = 'readonly'

You can confirm that the read-only manager is in use from GUI:

Users lose the ability to install and remove extensions from the Extension Manager; extensions must then be installed by an administrator in the environment.

Note: an egress policy that blocks outbound requests from the single-user server limits the reach of the URL variant, but does not address the file read or the file write.