JupyterLab EUVD-2026-89459

Exploitation requires ALL of: (1) the PyPI Extension Manager is enabled; (2) the attacker is an authenticated account that can call the extension API (PR:L); and (3) kernels and terminals are disabled or delegated to remote hosts - because otherwise the same user could already read files and make outbound requests directly, nullifying any escalation. The concrete injection vectors are pip option-like uninstall names: a requirements option (-r / --requirement=) to make the server read a local file or fetch an internal URL with content reflected via parse errors, or a --log option to create/corrupt a chosen path with pip-generated log text. Limiting factors: authentication is mandatory (not remote-unauthenticated), no arbitrary file content or arbitrary disclosed line can be chosen, and there is no code execution or availability impact beyond ordinary package removal.

This is a genuine but moderate-severity issue best characterized as argument (parameter) injection (CWE-88), not remote code execution despite the 'RCE' tag. The vendor CVSS3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N (5.4) is consistent with the description: an authenticated (PR:L) user with extension-API access injects pip option-like arguments into the uninstall path, yielding limited file read / internal-URL fetch (C:L) and limited path create/corrupt via pip logs (I:L), with no availability impact (A:N). No EPSS score, no CISA KEV listing, and no public exploit code are provided in the input, so exploitation status is 'no public exploit identified at time of analysis.' Critically, the vendor itself scopes the real impact narrowly: the security benefit only exists when kernels and terminals are disabled or delegated to remote hosts - otherwise an authenticated user can already read files and make outbound requests directly, making this a no-op escalation. There is no signal conflict between CVSS and description; both point to a constrained, authenticated, conditionally-exploitable flaw. Net assessment: a real defense-in-depth fix worth patching, but not an urgent widespread-exploitation priority. The 'RCE' tag overstates impact - the description explicitly states the injection 'does not add code execution or availability impact.'

In a locked-down JupyterHub-style deployment where kernels and terminals are disabled but the PyPI Extension Manager is left enabled, an authenticated low-privilege user calls the extension uninstall API and supplies an option-like extension name such as '-r/tmp/secret' or '--requirement=http://169.254.169.254/latest/meta-data/'. Because uninstall names were passed to 'python -m pip uninstall' without option validation, pip reads the local file or fetches the internal URL, and reflected parse errors return the first unparsable line or response content back to the attacker; a pip log option can also create/corrupt a chosen path. No public POC is referenced, though the fix commit and its regression tests demonstrate the exact malicious inputs.