8.8Hoch
CVE-2026-42266JupyterLab has an Extension Manager API/GUI Policy Discrepancy allowing 3rd party (malicious) extensions install via POST request.
Beschreibung
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.0.0 to 4.5.6, the allow-list of extensions that can be installed from PyPI Extension Manager (allowed_extensions_uris) is not correctly enforced by JupyterLab. The PyPI Extension Manager was not contained to packages listed on the default PyPI index. This vulnerability is fixed in 4.5.7.
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| jupyter | jupyterlab | 4.0.0 – < 4.5.7 | |
| jupyterlab | jupyterlab | >= 4.0.0, < 4.5.7 | |
| migration toolkit applications | 8.2 | — | |
| openshift ai | 3.4 | — | |
| Red Hat | Red Hat Migration Toolkit for Applications 8.2 | all versions | |
| Red Hat | Red Hat OpenShift AI 3.4 | all versions | |
| Red Hat | Red Hat OpenShift AI (RHOAI) | all versions |
Referenzen und Patches
- https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-37w4-hwhx-4rc4 MitigationVendor Advisory
- https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.7 PatchRelease Notes
- https://jupyterhub.readthedocs.io/en/5.2.1/explanation/websecurity.html Product
- https://jupyterlab.readthedocs.io/en/latest/user/extensions.html#extension-manager-implementations Product
- https://access.redhat.com/errata/RHSA-2026:43038
- https://access.redhat.com/errata/RHSA-2026:60520
- https://access.redhat.com/security/cve/CVE-2026-42266
- https://bugzilla.redhat.com/show_bug.cgi?id=2477072
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42266.json
CPE-Treffer (NVD) (1)
cpe:2.3:a:jupyter:jupyterlab:*:*:*:*:*:*:*:*≥ 4.0.0 < 4.5.7