CVE-2026-73627

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-73627", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-08-13T11:17:25.160Z", "datePublished": "2026-08-13T11:28:26.249Z", "dateUpdated": "2026-09-30T17:20:27.405Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-09-30T17:20:27.405Z"}, "datePublic": "2026-07-21T00:00:00.000Z", "title": "JupyterLab 4.6.0 Plugin Manager Lock-Rule Enforcement Bypass", "descriptions": [{"lang": "en", "value": "JupyterLab (pip package 'jupyterlab') versions >=4.1.0,<=4.5.9 and >=4.6.0,<=4.6.1 contain a plugin manager lock-rule enforcement bypass. Two server-side enforcement gaps allow an authenticated user to circumvent administrator lock rules by making direct requests to the /lab/api/plugins endpoint, enabling or disabling plugins that were locked \u2014 including child plugins of multi-plugin extensions and plugins locked via the 'lock all' mechanism. This can impact data integrity and bypass hardening or restrictions (e.g., download/upload limits) implemented through locked plugins. Fixed in versions 4.6.2 and 4.5.10."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Client-Side Enforcement of Server-Side Security", "cweId": "CWE-602", "type": "CWE"}]}], "affected": [{"vendor": "jupyterlab", "product": "jupyterlab", "defaultStatus": "unaffected", "packageURL": "pkg:pypi/jupyterlab", "versions": [{"version": "4.6.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "4.6.1"}]}, {"vendor": "jupyterlab", "product": "jupyterlab", "defaultStatus": "unaffected", "packageURL": "pkg:pypi/jupyterlab", "versions": [{"version": "4.1.0", "status": "affected", "versionType": "semver", "lessThanOrEqual": "4.5.9"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:jupyter:jupyterlab:4.1.0:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:jupyter:jupyterlab:4.5.0:rc0:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:jupyter:jupyterlab:4.5.0:rc1:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:jupyter:jupyterlab:4.5.0:-:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:jupyter:jupyterlab:4.5.1:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:jupyter:jupyterlab:4.5.2:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:jupyter:jupyterlab:4.5.3:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:jupyter:jupyterlab:4.5.4:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:jupyter:jupyterlab:4.5.5:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:jupyter:jupyterlab:4.5.6:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:jupyter:jupyterlab:4.5.7:*:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:jupyter:jupyterlab:4.6.0:alpha0:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:jupyter:jupyterlab:4.6.0:alpha1:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:jupyter:jupyterlab:4.6.0:alpha2:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:jupyter:jupyterlab:4.6.0:alpha3:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:jupyter:jupyterlab:4.6.0:alpha4:*:*:*:*:*:*"}, {"vulnerable": true, "criteria": "cpe:2.3:a:jupyter:jupyterlab:4.6.0:alpha5:*:*:*:*:*:*"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-h5v5-8746-g7mm", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-h5v5-8746-g7mm)"}, {"name": "VulnCheck Advisory: JupyterLab 4.6.0 Plugin Manager Lock-Rule Enforcement Bypass", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/jupyterlab-plugin-manager-lock-rule-enforcement-bypass"}], "credits": [{"lang": "en", "value": "rexpository", "type": "reporter"}, {"lang": "en", "value": "MUFFANUJ", "type": "finder"}, {"lang": "en", "value": "krassowski", "type": "coordinator"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-15T03:13:31.123307Z", "id": "CVE-2026-73627", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-15T03:13:40.300Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-73627", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-15T03:13:31.123307Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-15T03:13:35.927Z"}}], "cna": {"title": "JupyterLab 4.6.0 Plugin Manager Lock-Rule Enforcement Bypass", "credits": [{"lang": "en", "type": "reporter", "value": "rexpository"}, {"lang": "en", "type": "finder", "value": "MUFFANUJ"}, {"lang": "en", "type": "coordinator", "value": "krassowski"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}], "affected": [{"vendor": "jupyterlab", "product": "jupyterlab", "versions": [{"status": "unaffected", "version": "0", "lessThan": "4.6.0", "versionType": "semver"}], "packageURL": "pkg:pypi/jupyterlab", "defaultStatus": "affected"}, {"vendor": "jupyterlab", "product": "jupyterlab", "versions": [{"status": "unaffected", "version": "0", "lessThan": "4.1.0", "versionType": "semver"}], "packageURL": "pkg:pypi/jupyterlab", "defaultStatus": "affected"}], "datePublic": "2026-07-21T00:00:00.000Z", "references": [{"url": "https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-h5v5-8746-g7mm", "name": "GitHub Security Advisory (GHSA-h5v5-8746-g7mm)", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/jupyterlab-plugin-manager-lock-rule-enforcement-bypass", "name": "VulnCheck Advisory: JupyterLab 4.6.0 Plugin Manager Lock-Rule Enforcement Bypass", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "JupyterLab (pip package 'jupyterlab') versions >=4.1.0,<=4.5.9 and >=4.6.0,<=4.6.1 contain a plugin manager lock-rule enforcement bypass. Two server-side enforcement gaps allow an authenticated user to circumvent administrator lock rules by making direct requests to the /lab/api/plugins endpoint, enabling or disabling plugins that were locked \u2014 including child plugins of multi-plugin extensions and plugins locked via the 'lock all' mechanism. This can impact data integrity and bypass hardening or restrictions (e.g., download/upload limits) implemented through locked plugins. Fixed in versions 4.6.2 and 4.5.10."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-602", "description": "Client-Side Enforcement of Server-Side Security"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:jupyter:jupyterlab:4.1.0:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:jupyter:jupyterlab:4.5.0:rc0:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:jupyter:jupyterlab:4.5.0:rc1:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:jupyter:jupyterlab:4.5.0:-:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:jupyter:jupyterlab:4.5.1:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:jupyter:jupyterlab:4.5.2:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:jupyter:jupyterlab:4.5.3:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:jupyter:jupyterlab:4.5.4:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:jupyter:jupyterlab:4.5.5:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:jupyter:jupyterlab:4.5.6:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:jupyter:jupyterlab:4.5.7:*:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:jupyter:jupyterlab:4.6.0:alpha0:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:jupyter:jupyterlab:4.6.0:alpha1:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:jupyter:jupyterlab:4.6.0:alpha2:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:jupyter:jupyterlab:4.6.0:alpha3:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:jupyter:jupyterlab:4.6.0:alpha4:*:*:*:*:*:*", "vulnerable": true}, {"criteria": "cpe:2.3:a:jupyter:jupyterlab:4.6.0:alpha5:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-08-13T11:28:26.249Z"}}}, "cveMetadata": {"cveId": "CVE-2026-73627", "state": "PUBLISHED", "dateUpdated": "2026-08-15T03:13:40.300Z", "dateReserved": "2026-08-13T11:17:25.160Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-08-13T11:28:26.249Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:pypi/jupyterlab", "product": "jupyterlab", "vendor": "jupyterlab", "versions": [{"lessThanOrEqual": "4.6.1", "status": "affected", "version": "4.6.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "packageURL": "pkg:pypi/jupyterlab", "product": "jupyterlab", "vendor": "jupyterlab", "versions": [{"lessThanOrEqual": "4.5.9", "status": "affected", "version": "4.1.0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "JupyterLab (pip package 'jupyterlab') versions >=4.1.0,<=4.5.9 and >=4.6.0,<=4.6.1 contain a plugin manager lock-rule enforcement bypass. Two server-side enforcement gaps allow an authenticated user to circumvent administrator lock rules by making direct requests to the /lab/api/plugins endpoint, enabling or disabling plugins that were locked \u2014 including child plugins of multi-plugin extensions and plugins locked via the 'lock all' mechanism. This can impact data integrity and bypass hardening or restrictions (e.g., download/upload limits) implemented through locked plugins. Fixed in versions 4.6.2 and 4.5.10."}], "id": "CVE-2026-73627", "lastModified": "2026-09-30T18:18:39.947", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.0, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73627", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-15T03:13:31.123307Z", "version": "2.0.3"}}]}, "published": "2026-08-13T12:17:28.043", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-h5v5-8746-g7mm"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/jupyterlab-plugin-manager-lock-rule-enforcement-bypass"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-602"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "jupyterlab: JupyterLab: Plugin manager lock-rule bypass allows unauthorized plugin control", "id": "2515245", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515245"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N", "status": "draft"}, "cwe": "CWE-414", "details": ["JupyterLab (pip package 'jupyterlab') versions >=4.1.0,<=4.5.9 and >=4.6.0,<=4.6.1 contain a plugin manager lock-rule enforcement bypass. Two server-side enforcement gaps allow an authenticated user to circumvent administrator lock rules by making direct requests to the /lab/api/plugins endpoint, enabling or disabling plugins that were locked \u2014 including child plugins of multi-plugin extensions and plugins locked via the 'lock all' mechanism. This can impact data integrity and bypass hardening or restrictions (e.g., download/upload limits) implemented through locked plugins. Fixed in versions 4.6.2 and 4.5.10.", "A flaw was found in JupyterLab. An authenticated user can bypass administrator lock rules in the plugin manager by making direct requests to the `/lab/api/plugins` endpoint. This allows them to enable or disable plugins that were locked, including child plugins and those locked via the 'lock all' mechanism. This vulnerability can impact data integrity and circumvent hardening or restrictions implemented through locked plugins."], "name": "CVE-2026-73627", "package_state": [{"cpe": "cpe:/a:redhat:migration_toolkit_applications:8", "fix_state": "Affected", "package_name": "mta/mta-solution-server-rhel9", "product_name": "Migration Toolkit for Applications 8"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-feature-server-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-th06-cpu-torch210-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-th06-cpu-torch291-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-th06-cuda130-torch210-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-th06-cuda130-torch291-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-th06-rocm64-torch291-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}], "public_date": "2026-08-13T11:28:26Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-73627\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-73627\nhttps://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-h5v5-8746-g7mm\nhttps://www.vulncheck.com/advisories/jupyterlab-plugin-manager-lock-rule-enforcement-bypass"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,4.6.0)"}}], "enrichment": {"confidence": 92.0, "confidence_source": "matching", "scores": [{"score": 92.0, "source": "matching"}]}, "original": {"product": "jupyterlab", "source": "cna", "vendor": "jupyterlab"}, "product": "jupyterlab", "vendor": "jupyter"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,4.1.0)"}}], "enrichment": {"confidence": 92.0, "confidence_source": "matching", "scores": [{"score": 92.0, "source": "matching"}]}, "original": {"product": "jupyterlab", "source": "cna", "vendor": "jupyterlab"}, "product": "jupyterlab", "vendor": "jupyter"}], "created": "2026-08-13T13:30:17.319627+00:00", "updated": "2026-08-15T02:15:03.656237+00:00", "vendors": ["jupyter", "jupyter$PRODUCT$jupyterlab"]}