https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T14:26:02.677554+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-jupyterlab-2026-42266 BIT-jupyterlab-2026-42266 — JupyterLab has an Extension Manager API/GUI Policy Discrepancy allowing 3rd party (malicious) extensions install via PO… 2026-10-02T14:26:03.194656+00:00

Affected: Bitnami: jupyterlab

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.0.0 to 4.5.6, the allow-list of extensions that can be installed from PyPI Extension Manager (allowed_extensions_uris) is not correctly enforced by JupyterLab. The PyPI Extension Manager was not contained to packages listed on the default PyPI index. This vulnerability is fixed in 4.5.7.

 https://cve.radiocsirt.org/vuln/brew-jupyterlab-cve-2026-42266 BREW-jupyterlab-CVE-2026-42266 — JupyterLab has an Extension Manager API/GUI Policy Discrepancy, allowing 3rd party (malicious) extensions install via P… 2026-10-02T14:26:03.194748+00:00

Affected: Homebrew: jupyterlab

The allow-list of extensions that can be installed from PyPI Extension Manager (`allowed_extensions_uris`) is not correctly enforced by JupyterLab prior to 4.5.7. The PyPI Extension Manager was not contained to packages listed on the default PyPI index.

This has security implications for deployments that: - have allow-listed specific extensions with aim to prevent users from installing packages - have the kernel and terminals disabled or delegated to remote hosts (thus no access to install packages in the single-user server environment) - have multi-tenant deployments that is not configured for untrusted users (as per documented on JupyterHub https://jupyterhub.readthedocs.io/en/5.2.1/explanation/websecurity.html) - have the (default) PyPI Extension Manager enabled

### Impact

An authenticated attacker - such as a student in a shared JupyterHub environment or a user in a multi-tenant JupyterLab deployment - can escalate their privileges. This might allow for data exfiltration, lateral movement within the network, and persistent compromise of the server infrastructure.

### Patches

JupyterLab [`v4.5.7`](https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.7) contains the patch.

Users of applications that depend on JupyterLab, such as Notebook v7+, should update `jupyterlab` package too.

### Workarounds

Switch to read-only extension manager by adding the following command line option:

```bash --LabApp.extension_manager=readonly ```

or the following traitlet:

```…

 https://cve.radiocsirt.org/vuln/cleanstart-2026-gg76429 Withdrawn: CLEANSTART-2026-GG76429 — Security fixes in tensorflow-gpu-jupyter 2.21.0-r5 2026-10-02T14:26:03.194799+00:00

Withdrawn by the publisher.

Affected: CleanStart: tensorflow-gpu-jupyter

Package tensorflow-gpu-jupyter version 2.21.0-r5 fixes 28 vulnerabilities: ghsa-rch3-82jr-f9w9, ghsa-mqcg-5x36-vfcg, ghsa-37w4-hwhx-4rc4, ghsa-mf9v-mfxr-j63j, ghsa-5mrq-x3x5-8v8f...

 https://cve.radiocsirt.org/vuln/euvd-2026-361077 EUVD-2026-361077 2026-10-02T14:26:03.194822+00:00 EUVD-2026-361077 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42266 fkie_cve-2026-42266 2026-10-02T14:26:03.194837+00:00

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.0.0 to 4.5.6, the allow-list of extensions that can be installed from PyPI Extension Manager (allowed_extensions_uris) is not correctly enforced by JupyterLab. The PyPI Extension Manager was not contained to packages listed on the default PyPI index. This vulnerability is fixed in 4.5.7.

 https://cve.radiocsirt.org/vuln/ghsa-37w4-hwhx-4rc4 GHSA-37w4-hwhx-4rc4 — JupyterLab has an Extension Manager API/GUI Policy Discrepancy, allowing 3rd party (malicious) extensions install via P… 2026-10-02T14:26:03.194861+00:00

Affected: PyPI: jupyterlab

The allow-list of extensions that can be installed from PyPI Extension Manager (`allowed_extensions_uris`) is not correctly enforced by JupyterLab prior to 4.5.7. The PyPI Extension Manager was not contained to packages listed on the default PyPI index.

This has security implications for deployments that: - have allow-listed specific extensions with aim to prevent users from installing packages - have the kernel and terminals disabled or delegated to remote hosts (thus no access to install packages in the single-user server environment) - have multi-tenant deployments that is not configured for untrusted users (as per documented on JupyterHub https://jupyterhub.readthedocs.io/en/5.2.1/explanation/websecurity.html) - have the (default) PyPI Extension Manager enabled

### Impact

An authenticated attacker - such as a student in a shared JupyterHub environment or a user in a multi-tenant JupyterLab deployment - can escalate their privileges. This might allow for data exfiltration, lateral movement within the network, and persistent compromise of the server infrastructure.

### Patches

JupyterLab [`v4.5.7`](https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.7) contains the patch.

Users of applications that depend on JupyterLab, such as Notebook v7+, should update `jupyterlab` package too.

### Workarounds

Switch to read-only extension manager by adding the following command line option:

```bash --LabApp.extension_manager=readonly ```

or the following traitlet:

```…

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10748-1 openSUSE-SU-2026:10748-1 — jupyter-jupyterlab-4.5.7-1.1 on GA media 2026-10-02T14:26:03.194903+00:00

jupyter-jupyterlab-4.5.7-1.1 on GA media

 https://cve.radiocsirt.org/vuln/pysec-2026-164 PYSEC-2026-164 2026-10-02T14:26:03.194923+00:00

Affected: PyPI: jupyterlab

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.0.0 to 4.5.6, the allow-list of extensions that can be installed from PyPI Extension Manager (allowed_extensions_uris) is not correctly enforced by JupyterLab. The PyPI Extension Manager was not contained to packages listed on the default PyPI index. This vulnerability is fixed in 4.5.7.

 https://cve.radiocsirt.org/vuln/rhsa-2026:43038 RHSA-2026:43038 — Red Hat Security Advisory: Migration Toolkit for Applications 2026-10-02T14:26:03.194943+00:00

jupyter-server: jupyter-server: Sensitive data exposure via path traversal vulnerability fast-uri: fast-uri: URI authority bypass due to improper delimiter handling fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following mistune: Mistune: Regular Expression Denial of Service (ReDoS) via crafted Markdown input net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load() jupyter-server: Jupyter Server: Unauthorized File Access via Path Traversal Vulnerability net/mail: golang: Go net/mail: Denial of Service via crafted email inputs golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing jupyter-server: Jupyter Server: Cross-Origin Resource Sharing (CORS) bypass via improper Origin header validation Jupyter Notebook: JupyterLab: @jupyter-notebook/help-extension: @jupyterlab/help-extension: Jupyter Notebook and JupyterLab: Session takeover via stored cross-site scripting jupyterlab: JupyterLab: Arbitrary code execution due to improper enforcement of extension allow-list net/mail: golang: net/mail…

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-42266 UBUNTU-CVE-2026-42266 2026-10-02T14:26:03.195018+00:00

Affected: Ubuntu:25.10: jupyterlab, Ubuntu:26.04:LTS: jupyterlab

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.0.0 to 4.5.6, the allow-list of extensions that can be installed from PyPI Extension Manager (allowed_extensions_uris) is not correctly enforced by JupyterLab. The PyPI Extension Manager was not contained to packages listed on the default PyPI index. This vulnerability is fixed in 4.5.7.