GHSA-3325-v43h-43rv: SSRF

JupyterLab's PyPI extension manager runs python -m pip uninstall with the extension name taken from the request body. ExtensionHandler.post validates the name for cmd=install but not for cmd=uninstall, so a name that begins with - reaches the command line and pip reads it as an option rather than as a package.

python cmdline = [ sys.executable, "-m", "pip", "uninstall", "--yes", "--no-input", extension, ]

An extension name of the form -r followed by a path therefore made pip open that path as a requirements file. pip's parse error quotes the line it could not read and names the file it came from, and JupyterLab returned that error in the response body, so the line reached the requester.

This has security implications only for deployments that combine all of the following:

- the (default) PyPI Extension Manager enabled, so that uninstall requests reach pip; - an authenticated account permitted to call the extension API; and - kernels and terminals disabled or delegated to remote hosts (otherwise a user with kernel access can read the same files and make the same outbound requests directly, regardless of this endpoint)

Unlike GHSA-37w4-hwhx-4rc4 and GHSA-89vp-jrxv-24w8, this does not need an allowlist or blocklist to be configured. The uninstall path never consulted the listing.

Impact

An authenticated user gains a read of server-side files and an outbound request from the server, both outside the confinement that the contents root and the disabled kernels were meant to provide. The user cannot choose which line of a file is returned, and cannot write content of their choosing.

Reading files the account cannot reach

-r<path> makes pip open the path as a requirements file. The first line that pip cannot parse as a requirement comes back in the response together with the path. Blank lines and # comments are skipped. A line that is a valid package name is accepted silently, and the request answers 201 with no message, so a secret made only of letters, digits, dots, hyphens and underscores is not disclosed. One line is returned per request, and the requester cannot select which one.

The same option distinguishes a missing path ([Errno 2] No such file or directory), an unreadable one ([Errno 13] Permission denied) and a directory ([Errno 21] Is a directory), so any path on the host can be probed for existence and readability.

Reaching hosts and ports the account cannot reach

-r also accepts a URL. pip fetches it with an ordinary GET from the server's network position and reflects the first unparsable line of the response body the same way. A response whose body is a single line comes back in full. In a deployment where the single-user server sits inside a private network, this reaches internal services and cloud instance metadata endpoints that the user has no other route to.

Writing files

--log=<path> makes pip create that file if it is absent and append its own log to it otherwise. The content is pip's log text, not text the requester chooses, so the effect is to create files at chosen paths and to corrupt a file that has to parse, such as a configuration file read at the next start.

What this does not add

The same endpoint already uninstalls any installed package when it is given an ordinary, valid package name, so the injection adds no availability impact beyond what the extension manager already permits. Deployments that treat that as unacceptable should use the read-only extension manager, as described below.

pip refuses --python after a subcommand name, and ignores editable entries in an uninstall requirements file, so neither gives code execution.

Patches

JupyterLab v4.6.4 and v4.5.11 contain the patch. The uninstall name is now validated as a PyPI package name in both the HTTP handler and PyPIExtensionManager.uninstall, and the pip command line carries an explicit -- before the package operand.

Users of applications that depend on JupyterLab, such as Notebook v7+, should update jupyterlab package too.

Workarounds

Deployments wanting to disable programmatic extension installation and removal entirely can switch to the read-only extension manager:

bash --LabApp.extensionmanager=readonly

or the following traitlet:

python c.LabApp.extensionmanager = 'readonly'

You can confirm that the read-only manager is in use from GUI:

<img width="293" height="293" alt="image" src="https://github.com/user-attachments/assets/8016c809-633e-4ed0-a5bc-6bc4793caa0f" />

Users lose the ability to install and remove extensions from the Extension Manager; extensions must then be installed by an administrator in the environment.

Note: an egress policy that blocks outbound requests from the single-user server limits the reach of the URL variant, but does not address the file read or the file write.