8.8Yüksek
CVE-2026-42266JupyterLab has an Extension Manager API/GUI Policy Discrepancy allowing 3rd party (malicious) extensions install via POST request.
Açıklama
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.0.0 to 4.5.6, the allow-list of extensions that can be installed from PyPI Extension Manager (allowed_extensions_uris) is not correctly enforced by JupyterLab. The PyPI Extension Manager was not contained to packages listed on the default PyPI index. This vulnerability is fixed in 4.5.7.
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| jupyter | jupyterlab | 4.0.0 – < 4.5.7 | |
| jupyterlab | jupyterlab | >= 4.0.0, < 4.5.7 | |
| migration toolkit applications | 8.2 | — | |
| openshift ai | 3.4 | — | |
| Red Hat | Red Hat Migration Toolkit for Applications 8.2 | all versions | |
| Red Hat | Red Hat OpenShift AI 3.4 | all versions | |
| Red Hat | Red Hat OpenShift AI (RHOAI) | all versions |
Kaynaklar ve yamalar
- https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-37w4-hwhx-4rc4 MitigationVendor Advisory
- https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.7 PatchRelease Notes
- https://jupyterhub.readthedocs.io/en/5.2.1/explanation/websecurity.html Product
- https://jupyterlab.readthedocs.io/en/latest/user/extensions.html#extension-manager-implementations Product
- https://access.redhat.com/errata/RHSA-2026:43038
- https://access.redhat.com/errata/RHSA-2026:60520
- https://access.redhat.com/security/cve/CVE-2026-42266
- https://bugzilla.redhat.com/show_bug.cgi?id=2477072
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42266.json
CPE eşleşmeleri (NVD) (1)
cpe:2.3:a:jupyter:jupyterlab:*:*:*:*:*:*:*:*≥ 4.0.0 < 4.5.7