CVE-2026-42266
High
Published: 13 May 2026
Published
13 May 2026
Modified
13 May 2026
KEV Added
—
Patch
—
CVSS Score
8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score
0.0006
19.3th percentile
Risk Priority
18
60% EPSS · 20% KEV · 20% CVSS
Summary
CVE-2026-42266 is a high-severity Argument Injection (CWE-88) vulnerability. Its CVSS base score is 8.8 (High).
Operationally, ranked at the 19.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
NVD Description
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.0.0 to 4.5.6, the allow-list of extensions that can be installed from PyPI Extension Manager (allowed_extensions_uris) is not correctly enforced by JupyterLab. The…
more
PyPI Extension Manager was not contained to packages listed on the default PyPI index. This vulnerability is fixed in 4.5.7.
Deeper analysisAI
Automated synthesis unavailable for this CVE.
Details
- CWE(s)