8.8Alta
CVE-2026-42266JupyterLab has an Extension Manager API/GUI Policy Discrepancy allowing 3rd party (malicious) extensions install via POST request.
Descripción
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.0.0 to 4.5.6, the allow-list of extensions that can be installed from PyPI Extension Manager (allowed_extensions_uris) is not correctly enforced by JupyterLab. The PyPI Extension Manager was not contained to packages listed on the default PyPI index. This vulnerability is fixed in 4.5.7.
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| jupyter | jupyterlab | 4.0.0 – < 4.5.7 | |
| jupyterlab | jupyterlab | >= 4.0.0, < 4.5.7 | |
| migration toolkit applications | 8.2 | — | |
| openshift ai | 3.4 | — | |
| Red Hat | Red Hat Migration Toolkit for Applications 8.2 | all versions | |
| Red Hat | Red Hat OpenShift AI 3.4 | all versions | |
| Red Hat | Red Hat OpenShift AI (RHOAI) | all versions |
Referencias y parches
- https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-37w4-hwhx-4rc4 MitigationVendor Advisory
- https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.7 PatchRelease Notes
- https://jupyterhub.readthedocs.io/en/5.2.1/explanation/websecurity.html Product
- https://jupyterlab.readthedocs.io/en/latest/user/extensions.html#extension-manager-implementations Product
- https://access.redhat.com/errata/RHSA-2026:43038
- https://access.redhat.com/errata/RHSA-2026:60520
- https://access.redhat.com/security/cve/CVE-2026-42266
- https://bugzilla.redhat.com/show_bug.cgi?id=2477072
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42266.json
Coincidencias CPE (NVD) (1)
cpe:2.3:a:jupyter:jupyterlab:*:*:*:*:*:*:*:*≥ 4.0.0 < 4.5.7