PyPI: jupyterlab
CVE-2026-42266
Safety vulnerability ID: SFTY-20260505-46550
Safety legacy ID: pyup.io-96033
Affected versions of the jupyterlab package are vulnerable to Improper Access Control because the PyPI Extension Manager fails to enforce the configured extension allow list. The allowed_extensions_uris configuration setting was not correctly applied by the PyPI Extension Manager, and the manager itself was not constrained to packages served from the default PyPI index, so administrative restrictions intended to prevent users from installing arbitrary packages did not take effect.
Overview
JupyterLab has an Extension Manager API/GUI Policy Discrepancy, allowing 3rd party (malicious) extensions install via POST request
Advisory
Affected versions of the jupyterlab package are vulnerable to Improper Access Control because the PyPI Extension Manager fails to enforce the configured extension allow list. The allowed_extensions_uris configuration setting was not correctly applied by the PyPI Extension Manager, and the manager itself was not constrained to packages served from the default PyPI index, so administrative restrictions intended to prevent users from installing arbitrary packages did not take effect.
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20260505-46550/CVE-2026-42266
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42266
- https://data.safetycli.com/changelogs/jupyterlab/
- https://github.com/advisories/GHSA-37w4-hwhx-4rc4
- https://github.com/jupyterlab/jupyterlab/commit/8e32ac11ff41983925de2d0c24904d54c6b742ab
- https://pypi.org/project/jupyterlab
- https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-37w4-hwhx-4rc4
- https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.7
- https://jupyterhub.readthedocs.io/en/5.2.1/explanation/websecurity.html
- https://jupyterlab.readthedocs.io/en/latest/user/extensions.html#extension-manager-implementations
- https://nvd.nist.gov/vuln/detail/CVE-2026-42266
- https://github.com/pypa/advisory-database/tree/main/vulns/jupyterlab/PYSEC-2026-164.yaml
- https://github.com/advisories/GHSA-37w4-hwhx-4rc4
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more