CVE-2026-42266

Katalog CVE

CVSS 8.8 · High EPSS 0,85%

Kerentanan Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') pada jupyterlab. Skor CVSS 3.1 8.8 (High) menurut github.com.

Deskripsi (NVD)

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.0.0 to 4.5.6, the allow-list of extensions that can be installed from PyPI Extension Manager (allowed_extensions_uris) is not correctly enforced by JupyterLab. The PyPI Extension Manager was not contained to packages listed on the default PyPI index. This vulnerability is fixed in 4.5.7.

Rincian

Terbit di NVD

13 Mei 2026

Terakhir diubah

28 Agustus 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
CWE-602: Client-Side Enforcement of Server-Side Security

EPSS (30 hari)

0,85% peluang dieksploitasi; lebih tinggi dari 57,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-37w4-hwhx-4rc4 mitigasi · advisory vendor
• https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.7 patch · release notes
• https://jupyterhub.readthedocs.io/en/5.2.1/explanation/websecurity.html product
• https://jupyterlab.readthedocs.io/en/latest/user/extensions.html#extension-manager-implementations product
• https://access.redhat.com/errata/RHSA-2026:43038
• https://access.redhat.com/errata/RHSA-2026:60520
• https://access.redhat.com/security/cve/CVE-2026-42266
• https://bugzilla.redhat.com/show_bug.cgi?id=2477072
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42266.json