CVE-2026-54527
CriticalCVSS 9.0Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
The JupyterLab Git extension before version 0.54.0 contains an XSS vulnerability in the createHeader() method of PlainTextDiff.ts. When rendering renamed files in commit history, filenames are passed directly to innerHTML, allowing a crafted filename to execute JavaScript when a victim views the rename diff in the Git History tab.
Risk Assessment
An attacker can exploit this vulnerability to execute arbitrary JavaScript in the victim's browser when they view the commit history in the Git History tab. This could lead to session theft, data modification, or further attacks on the user.
Recommendation
Immediately update the JupyterLab Git extension to version 0.54.0 or later. If updating is not possible, avoid viewing commit history with suspicious filenames.
Original NVD description (English source)
JupyterLab Git is a Git extension for JupyterLab. From 0.30.0b3 before 0.54.0, the PlainTextDiff.ts createHeader() method passes Git filenames directly to innerHTML when rendering renamed files in commit history, allowing a crafted filename to execute JavaScript when a victim views the rename diff in the Git History tab. This issue is fixed in version 0.54.0.