CVE-2026-42266
High · 8.8CVSS
8.8
EPSS
0.9%
Published
May 13, 2026
CISA due date
—
The record
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.0.0 to 4.5.6, the allow-list of extensions that can be installed from PyPI Extension Manager (allowed_extensions_uris) is not correctly enforced by JupyterLab. The PyPI Extension Manager was not contained to packages listed on the default PyPI index. This vulnerability is fixed in 4.5.7.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | python-jupyterlab | 0 | 4.5.7-1.1 |
Related vulnerabilities
- CVE-2026-42557 jupyterlab is an extensible environment for interactive and reproducible computing, based… Also affects python-jupyterlab
- CVE-2026-40171 In Jupyter Notebook versions 7.0.0 through 7.5.5, JupyterLab versions 4.5.6 and earlier… Also affects python-jupyterlab
- CVE-2026-112944 launch-editor allows users to open files with line numbers in editor from Node.js. CWE-88
- CVE-2026-112900 Pillow is a Python imaging library. CWE-88
- CVE-2026-105326 An argument injection flaw was found in CUPS. CWE-88
- CVE-2026-102827 simple-git, an interface for running git commands in any node.js application, enables… CWE-88
- CVE-2026-89066 Improper neutralization of special elements used in an OS command in the task synthesis… CWE-88
- CVE-2026-11765 Improper neutralization of argument delimiters in a command ('argument injection')… CWE-88