CVE-2026-102904

A moderate-impact argument injection flaw in JupyterLab affects Red Hat OpenShift AI, which ships the vulnerable JupyterLab releases in its workbench and distributed-workload notebook images, and the Migration Toolkit for Applications 8.1 solution server image, which also ships JupyterLab. When JupyterLab processes an extension uninstallation request through the PyPI Extension Manager, the user-supplied extension name is passed to python -m pip uninstall without rejecting option-like values. An authenticated user permitted to call the extension API can exploit this to inject pip command-line options: a requirements option such as -r makes the server read a local file or fetch an internal URL, with pip's reflected parse error returning the first unparsable line and the path to the requester, and a log option such as --log can create or corrupt a chosen path with pip-generated log text. The requester cannot choose which line of a file is disclosed and cannot write content of their choosing, and the injection adds no code execution or availability impact beyond what the extension manager already permits. The issue has security implications only where the PyPI Extension Manager is enabled, the account can call the extension API, and kernels and terminals are disabled or delegated to remote hosts; otherwise such users can already read the same files and make the same outbound requests directly. Red Hat rates this flaw Moderate with a CVSS 3.1 score of 5.4, matching the upstream severity. Because the impact is Moderate with a CVSS score below 7.0, fixes for the affected Red Hat OpenShift AI components are deferred, leaving a residual risk of local file disclosure, internal network probing, and pip log file corruption by authenticated users with extension API access. The affected Migration Toolkit for Applications 8.1 stream is out of support scope.