CVE-2026-42266
High
Description
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.0.0 to 4.5.6, the allow-list of extensions that can be installed from PyPI Extension Manager (allowed_extensions_uris) is not correctly enforced by JupyterLab. The PyPI Extension Manager was not contained to packages listed on the default PyPI index. This vulnerability is fixed in 4.5.7.
SeverityHigh
CVSS8.8
Exploit probability—
ProductJupyterlab
PublishedMay 13, 2026
First seenMay 13, 2026
Weakness typeCWE-88CWE-88CWE-602CWE-602
How to fix
Update
- jupyter jupyterlab4.5.7 or later
- jupyterlab4.5.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jupyter jupyterlab | 4.0.0 ≤ v < 4.5.7 | 4.5.7 |
| jupyterlabPyPI | 4.0.0 ≤ v < 4.5.7 | 4.5.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.