CVE-2026-54527 Details
Description
JupyterLab Git is a Git extension for JupyterLab. From 0.30.0b3 before 0.54.0, the PlainTextDiff.ts createHeader() method passes Git filenames directly to innerHTML when rendering renamed files in commit history, allowing a crafted filename to execute JavaScript when a victim views the rename diff in the Git History tab. This issue is fixed in version 0.54.0.
A stored cross-site scripting vulnerability has been identified in the JupyterLab Git extension, specifically in versions 0.30.0b3 prior to 0.54.0. The issue arises in the PlainTextDiff component, where the createHeader() method renders filenames from renamed files in commit history directly into the innerHTML without proper sanitization. This oversight allows an attacker to inject malicious JavaScript that executes when a user views the renamed file's diff in the Git History tab. The vulnerability can be exploited by crafting a filename with a JavaScript payload, renaming a file in a Git repository, and then having a victim view the commit history.
Users can update to JupyterLab Git version 0.54.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/jupyterlab/jupyterlab-git/security/advisories/GHSA-f962-v9hr-pfg5 | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/jupyterlab/jupyterlab-git/commit/c6d37b88f36aa59aee317930b95e427fb9d6b09b | [email protected] | Patch |
| https://github.com/jupyterlab/jupyterlab-git/releases/tag/v0.54.0 | [email protected] | Release Notes |
| https://github.com/jupyterlab/jupyterlab-git/security/advisories/GHSA-f962-v9hr-pfg5 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| jupyter jupyterlab-git | >= 0.30.1, < 0.54.0 0.30.0 - 0.30.0 beta3 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | Initial Analysis | [email protected] |
| Jul 9, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2026 | New CVE Received | [email protected] |