CVE-2026-42266
Fixed in a distro release EPSS 6%CVSS 8.8
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.0.0 to 4.5.6, the allow-list of extensions that can be installed from PyPI Extension Manager (allowed_extensions_uris) is not correctly enforced by JupyterLab. The PyPI Extension Manager was not contained to packages listed on the default PyPI index. This vulnerability is fixed in 4.5.7.
Products: jupyterlab, Red Hat Migration Toolkit for Applications 8.2, Red Hat OpenShift AI 3.4, Red Hat OpenShift AI (RHOAI)
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | jupyterlab | 4.5.7 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | datahub-ingestion | 1.5.0.4-r0 |
| Chainguard | datahub-ingestion-fips | 1.5.0.1-r2 |
| Debian 13 | jupyterlab | no fix |
| Debian 14 | jupyterlab | 4.4.10+ds1+~3.1.0+~0.16.6+~cs1.4.4-3 |
| Ubuntu 25.10 | jupyterlab | no fix |
| Ubuntu 26.04 LTS | jupyterlab | no fix |
| Ubuntu 26.10 | jupyterlab | no fix |
| openSUSE Tumbleweed | python-jupyterlab | 4.5.7-1.1 |