Threats tagged 'brew-jupyterlab-cve-2026-42266'

JupyterLab versions prior to 4.5.7 have a vulnerability where the allow-list for extensions installable via the PyPI Extension Manager is not properly enforced. This allows authenticated users in multi-tenant or restricted environments to install arbitrary third-party extensions, potentially escalating privileges and compromising server security. The issue is patched in version 4.5.7. Workarounds include switching the extension manager to read-only mode.