CVE-2026-42266

EUVD-2026-29995
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.0.0 to 4.5.6, the allow-list of extensions that can be installed from PyPI Extension Manager (allowed_extensions_uris) is not correctly enforced by JupyterLab. The PyPI Extension Manager was not contained to packages listed on the default PyPI index. This vulnerability is fixed in 4.5.7.
Argument Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 43.3%
Affected Products (NVD)
VendorProductVersion
jupyterjupyterlab
4.0.0 ≤
𝑥
< 4.5.7
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
Red HatRed Hat Migration Toolkit for Applications 8.2
1784109883 ≤
𝑥
< *
ADP
Debian logo
Debian Releases
Debian Product
Codename
jupyterlab
forky
4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-3
fixed
sid
4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-3
fixed
trixie
vulnerable
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
jupyterlab
jammy
dne
noble
dne
questing
ignored
resolute
needs-triage
Common Weakness Enumeration
References
https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.7
https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-37w4-hwhx-4rc4
https://jupyterhub.readthedocs.io/en/5.2.1/explanation/websecurity.html
https://jupyterlab.readthedocs.io/en/latest/user/extensions.html#extension-manager-implementations
https://access.redhat.com/errata/RHSA-2026:43038
https://access.redhat.com/security/cve/CVE-2026-42266
https://bugzilla.redhat.com/show_bug.cgi?id=2477072
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42266.json