Log in Start free

Vulnerability · Published May 13, 2026 · Assigned by GitHub_M

CVE-2026-42266JupyterLab has an Extension Manager API/GUI Policy Discrepancy allowing 3rd party (malicious) extensions install via POST request.

High 8.8

In plain English

A high-severity argument injection in jupyterlab from jupyterlab. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 5.7% (higher than 93% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)5.7%top 7.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.0.0 to 4.5.6, the allow-list of extensions that can be installed from PyPI Extension Manager (allowed_extensions_uris) is not correctly enforced by JupyterLab. The PyPI Extension Manager was not contained to packages listed on the default PyPI index. This vulnerability is fixed in 4.5.7.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13jupyterlabno fix listedDEBIAN-CVE-2026-42266
Debian:14jupyterlab4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-3DEBIAN-CVE-2026-42266
PyPIjupyterlab4.5.7PYSEC-2026-164
PyPIjupyterlab4.5.7GHSA-37w4-hwhx-4rc4
Ubuntu:25.10jupyterlabno fix listedUBUNTU-CVE-2026-42266
Ubuntu:26.04:LTSjupyterlabno fix listedUBUNTU-CVE-2026-42266
Ubuntu:26.10jupyterlabno fix listedUBUNTU-CVE-2026-42266

Affected products (as reported)

VendorProductVersions
jupyterlab jupyterlab >= 4.0.0, < 4.5.7

Weakness: CWE-88, CWE-602 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References