Yes. The JupyterLab documentation says that installing an extension allows it to execute arbitrary code on the server, in the kernel and in the browser. An extension is effectively software with the same access as your notebook session, so vet it like any dependency, and limit who may install them.
What an extension can reach
A notebook environment holds a lot: data files, cloud credentials in environment variables, access to warehouses, and often a network path into internal systems. An extension runs inside that environment. It can see what you see.
The docs also note two supporting facts. Source extensions require installing Node.js and rebuilding JupyterLab. And by default, the extension manager uses PyPI.org as the source and pip to install, so the usual package ecosystem risks apply: typosquats, abandoned projects and compromised releases.
Why data teams should care
| Where it runs | What it might touch |
|---|---|
| Browser | Notebook contents, outputs, cell text, clipboard actions the UI allows |
| Server | Files, tokens, environment variables |
| Kernel | Variables in memory, database connections, query results |
A malicious extension does not need a vulnerability. It already has the permissions you gave it by installing it.
What to ask before installing
- Who maintains it? Look at the repository, release history and the organization.
- Is the name right? Check it is the project you intended and not a lookalike.
- What does it need? A theme should not need network access. Read the source of anything that handles credentials or data.
- Is it needed at all? Many are conveniences.
- Which version will you pin? Record it in your environment file.
Controls from the docs
The JupyterLab docs describe allowlists, blocklists, a read only extension manager and locking. We cover the steps in how to lock down the JupyterLab extension manager. The docs also warn that extension manager listings are not a substitute for isolating the server environment from user controlled kernels in multi user deployments.
A habit that helps
Treat the notebook image as a build artifact: install the approved extensions in the image, pin versions, scan it, and give users no install rights at run time. Also see exposed Jupyter servers.
Quick check
Is a JupyterLab theme extension harmless?
Do not assume it. The docs say an installed extension can execute arbitrary code on the server, kernel and browser.
Does disabling an extension remove its code?
Per the docs, disabling stops its plugins from running but its code still loads. Uninstall to remove it.
Safeguard can inventory the Python packages in a notebook environment and check them against known advisories. A free scan is at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
