CVE-2026-54527
criticalJupyterLab Git is a Git extension for JupyterLab.
Vendor / product: Jupyter — jupyterlab-git
JupyterLab Git is a Git extension for JupyterLab. From 0.30.0b3 before 0.54.0, the PlainTextDiff.ts createHeader() method passes Git filenames directly to innerHTML when rendering renamed files in commit history, allowing a crafted filename to execute JavaScript when a victim views the rename diff in the Git History tab. This issue is fixed in version 0.54.0.
CVSS
9.0
9.0 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2026-07-08 21:16
Modified: 2026-10-25 17:10
NVD status: Analyzed
Last synced 2 days ago
Verified against the source API 2026-10-27 07:07 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
jupyter / jupyterlab-git ≥0.30.1 <0.54.0, 0.30.0
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Vendor advisory: https://github.com/jupyterlab/jupyterlab-git/security/advisories/GHSA-f962-v9hr-pfg5
Vendor advisory: https://github.com/jupyterlab/jupyterlab-git/security/advisories/GHSA-f962-v9hr-pfg5
Patch / mitigation: https://github.com/jupyterlab/jupyterlab-git/commit/c6d37b88f36aa59aee317930b95e427fb9d6b09b
References
- https://github.com/jupyterlab/jupyterlab-git/commit/c6d37b88f36aa59aee317930b95e427fb9d6b0... security-advisories@github.com
- https://github.com/jupyterlab/jupyterlab-git/releases/tag/v0.54.0 security-advisories@github.com
- https://github.com/jupyterlab/jupyterlab-git/security/advisories/GHSA-f962-v9hr-pfg5 security-advisories@github.com
- https://github.com/jupyterlab/jupyterlab-git/security/advisories/GHSA-f962-v9hr-pfg5 134c704f-9b21-4f2e-91b3-4a467353bcc0
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 07:07 UTC · record ↗