JupyterLab CVE-2026-42266

Exploitation requires four specific conditions: (1) PyPI Extension Manager must be enabled (this is the default configuration in JupyterLab), (2) the deployment must use an extension allow-list via allowed_extensions_uris configuration (vulnerability only manifests when admins attempt to restrict extensions), (3) attacker must possess valid authenticated user credentials (PR:L indicates low-privilege user access suffices), and (4) deployment must be multi-tenant or shared (single-user deployments see reduced impact as users already have equivalent package installation capabilities). Exploitation is NOT possible if: extension manager is configured in read-only mode, JupyterLab is running in single-user mode where the user already has direct pip install access, or the deployment does not use allow-list restrictions (though this represents insecure configuration). The CVSS vector AV:N/AC:L/PR:L/UI:N confirms network accessibility with low complexity and no user interaction required beyond initial authentication.

This vulnerability presents high real-world risk in specific deployment contexts despite moderate CVSS score nuances. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates network-accessible exploitation requiring only low-privilege authentication with no user interaction, yielding high impact across confidentiality, integrity, and availability (C:H/I:H/A:H). However, real-world risk is highly context-dependent: deployments using default configurations with PyPI Extension Manager enabled and multi-tenant access models face immediate exposure, while single-user or properly isolated deployments see reduced impact. No public exploit identified at time of analysis and not listed in CISA KEV, suggesting exploitation has not yet become widespread. The attack complexity is objectively low (direct POST request to install extensions), making this highly automatable once an attacker gains authenticated access. Priority assessment depends on deployment model: CRITICAL for shared JupyterHub educational environments and multi-tenant SaaS offerings where students or untrusted users have authenticated access; MEDIUM for single-user research deployments. The vendor's explicit mention of data exfiltration, lateral movement, and persistent compromise scenarios indicates this enables full environment takeover in vulnerable configurations.

An authenticated student in a university JupyterHub environment or a low-privilege user in a multi-tenant JupyterLab deployment crafts a direct POST request to the JupyterLab extension manager API endpoint, requesting installation of a malicious Python package from PyPI that is not on the administrator-configured allow-list. The server fails to validate the request against allowed_extensions_uris, installs the malicious package, and grants the attacker arbitrary code execution within the JupyterLab server context. The attacker leverages this access to exfiltrate sensitive data from other users' notebooks, establish persistence through scheduled tasks, and pivot to adjacent network resources accessible from the server.