p PatchFirst

CVE-2026-54527

CVE-2026-54527 · JupyterLab Git: Stored XSS leading to RCE

This page contains facts from public vulnerability sources. Check the original advisory before updating.

JupyterLab Git is a Git extension for JupyterLab. From 0.30.0b3 before 0.54.0, the PlainTextDiff.ts createHeader() method passes Git filenames directly to innerHTML when rendering renamed files in commit history, allowing a crafted filename to execute JavaScript when a victim views the rename diff in the Git History tab. This issue is fixed in version 0.54.0.

CVSS 9.3 · Critical · EPSS 0.5% · Fix available

Published
Updated

Stack: python · node

Affected products and versions

  • jupyterlab-git

    Versions
    • >= 0.30.0b3, < 0.54.0: Affected

    No fix published

  • jupyterlab-git PyPI

    Versions
    • 0.30.0
    • 0.30.0b3
    • 0.30.1
    • 0.31.0
    • 0.31.0a0
    • 0.32.0
    • 0.32.1
    • 0.32.2
    • 0.32.3
    • 0.32.4
    • 0.33.0
    • 0.34.0
    • 0.34.1
    • 0.34.2
    • 0.35.0
    • 0.36.0
    • 0.37.0
    • 0.37.1
    • 0.38.0
    • 0.39.0
    • 0.39.1
    • 0.39.2
    • 0.39.3
    • 0.40.0
    • 0.40.1
    • 0.41.0
    • 0.42.0
    • 0.42.0rc0
    • 0.43.0
    • 0.44.0
    • 0.50.0
    • 0.50.0a0
    • 0.50.0a1
    • 0.50.0a2
    • 0.50.0rc0
    • 0.50.1
    • 0.50.2
    • 0.51.0
    • 0.51.1
    • 0.51.2
    • 0.51.3
    • 0.51.4
    • 0.52.0
    • 0.53.0
    • 0.53.0a0
    • 0.53.0a1
    • 0.54.0a0
    • 0.54.0a1
    Affected ranges
    • ECOSYSTEM: ≥ 0.30.0b3, < 0.54.0

    Update to 0.54.0

  • jupyterlab-git-core PyPI

    Versions
    • 0.53.0
    • 0.53.0a1
    • 0.54.0a0
    • 0.54.0a1
    Affected ranges
    • ECOSYSTEM: ≥ 0.30.0b3, < 0.54.0

    Update to 0.54.0

  • @jupyterlab/git npm

    Affected ranges
    • SEMVER: ≥ 0.30.0-beta.3, < 0.54.0

    Update to 0.54.0

Original sources

Check your server →