JupyterLab has an Extension Manager API/GUI Policy Discrepancy, allowing 3rd party (malicious) extensions install via POST request (CVE-2026-42266) | HOL Guard CVE