PT-2026-37256 · Project Jupyter · Jupyterlab

Pmcao · Published 2026-05-05 · Updated 2026-05-21 · CVE-2026-42266

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JupyterLab versions prior to 4.5.7

Description The PyPI Extension Manager does not correctly enforce the allowed extensions uris allow-list, allowing the installation of packages not listed on the default PyPI index. This issue affects deployments that use allow-lists to restrict package installation, have disabled kernels and terminals, or utilize multi-tenant configurations not set up for untrusted users. An authenticated attacker can exploit this to escalate privileges, potentially leading to data exfiltration, lateral movement within the network, and persistent compromise of the server infrastructure.

Recommendations Update to version 4.5.7. As a temporary workaround, switch to a read-only extension manager by using the command line option --LabApp.extension manager=readonly or the traitlet c.LabApp.extension manager = 'readonly'.

Fix

Argument Injection

RCE

Weakness Enumeration

CWE-88

CWE-602

CWE-20

Related Identifiers

BIT-JUPYTERLAB-2026-42266

CVE-2026-42266

GHSA-37W4-HWHX-4RC4

OPENSUSE-SU-2026:10748-1

PYSEC-2026-164

Affected Products

Jupyterlab

References · 23

• https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.7 · Patch
• https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-37w4-hwhx-4rc4 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10748-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-42266 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-42266 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-42266 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42266 · Security Note
• https://ubuntu.com/security/CVE-2026-42266 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-jupyterlab-2026-42266 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-37w4-hwhx-4rc4 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-42266 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-164 · Vendor Advisory
• https://github.com/jupyterlab/jupyterlab · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/jupyterlab/PYSEC-2026-164.yaml · Note
• https://suse.com/security/cve/CVE-2026-40171 · Note