CVE-2026-42266

[CVE catalog]

Severity

High · CVSS 8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Published

May 5, 2026, 8:53:18 PM UTC

Source

[NVD] · [CVE record]

EPSS

5.65% · Oct 25, 2026

A flaw was found in JupyterLab, an extensible environment for interactive computing. The PyPI Extension Manager, responsible for installing extensions, failed to properly enforce its allow-list of approved extensions. This vulnerability allowed for the installation of unauthorized extensions from sources outside the default PyPI index. Exploitation of this flaw could lead to arbitrary code execution and significant system compromise. jupyterlab: JupyterLab: Arbitrary code execution due to improper enforcement of extension allow-list This Important flaw in JupyterLab, as utilized in Red Hat OpenShift AI and Migration Toolkit for Applications, stems from the PyPI Extension Manager's failure to enforce its extension allow-list. This enables the installation of unauthorized extensions from external sources, potentially leading to arbitrary code execution and significant system compromise within the JupyterLab environment. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.