CVE-2026-102904: JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs

JupyterLab’s PyPI extension manager runs python -m pip uninstall with the extension name taken from the request body. ExtensionHandler.post validates the name for cmd=install but not for cmd=uninstall, so a name that begins with - reaches the command line and pip reads it as an option rather than as a package.

cmdline = [
sys.executable,
"-m",
"pip",
"uninstall",
"--yes",
"--no-input",
extension,
]

An extension name of the form -r followed by a path therefore made pip open that path as a requirements file. pip’s parse error quotes the line it could not read and names the file it came from, and JupyterLab returned that error in the response body, so the line reached the requester.

This has security implications only for deployments that combine all of the following:

• the (default) PyPI Extension Manager enabled, so that uninstall requests reach pip;
• an authenticated account permitted to call the extension API; and
• kernels and terminals disabled or delegated to remote hosts (otherwise a user with kernel access can read the same files and make the same outbound requests directly, regardless of this endpoint)