CVE-2026-54527

JupyterLab Git is a Git extension for JupyterLab. From 0.30.0b3 before 0.54.0, the PlainTextDiff.ts createHeader() method passes Git filenames directly to innerHTML when rendering renamed files in commit history, allowing a crafted filename to execute JavaScript when a victim views the rename diff in the Git History tab. This issue is fixed in version 0.54.0.

CVSS v3 9.0 CRITICAL

9.0^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/jupyterlab/jupyterlab-git/commit/c6d37b88f36aa59aee317930b95e427fb9d6b09b	Patch
https://github.com/jupyterlab/jupyterlab-git/releases/tag/v0.54.0	Release Notes
https://github.com/jupyterlab/jupyterlab-git/security/advisories/GHSA-f962-v9hr-pfg5	Exploit Mitigation Vendor Advisory
https://github.com/jupyterlab/jupyterlab-git/security/advisories/GHSA-f962-v9hr-pfg5	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:jupyter:jupyterlab-git::::::::
	cpe:2.3:a:jupyter:jupyterlab-git:0.30.0:-::::::
	cpe:2.3:a:jupyter:jupyterlab-git:0.30.0:beta3::::::

History

25 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) JupyterLab Git es una extensión de Git para JupyterLab. Desde la versión 0.30.0b3 hasta la 0.54.0, el método createHeader() de PlainTextDiff.ts pasa los nombres de archivo de Git directamente a innerHTML al renderizar archivos renombrados en el historial de commits, permitiendo que un nombre de archivo manipulado ejecute JavaScript cuando una víctima ve la diferencia de renombrado en la pestaña Historial de Git. Este problema se ha corregido en la versión 0.54.0.

Information

Published : 2026-07-08 21:16

Updated : 2026-10-25 17:10

NVD link : CVE-2026-54527

Mitre link : CVE-2026-54527

CVE.ORG link : CVE-2026-54527

JSON object : View

Products Affected

jupyter

jupyterlab-git

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-54527", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54527", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-09T14:15:09.351241Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "jupyterlab", "product": "jupyterlab-git", "versions": [{"status": "affected", "version": ">= 0.30.0b3, < 0.54.0"}]}]}], "published": "2026-07-08T21:16:49.273", "references": [{"url": "https://github.com/jupyterlab/jupyterlab-git/commit/c6d37b88f36aa59aee317930b95e427fb9d6b09b", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/jupyterlab/jupyterlab-git/releases/tag/v0.54.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/jupyterlab/jupyterlab-git/security/advisories/GHSA-f962-v9hr-pfg5", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/jupyterlab/jupyterlab-git/security/advisories/GHSA-f962-v9hr-pfg5", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "JupyterLab Git is a Git extension for JupyterLab. From 0.30.0b3 before 0.54.0, the PlainTextDiff.ts createHeader() method passes Git filenames directly to innerHTML when rendering renamed files in commit history, allowing a crafted filename to execute JavaScript when a victim views the rename diff in the Git History tab. This issue is fixed in version 0.54.0."}, {"lang": "es", "value": "JupyterLab Git es una extensi\u00f3n de Git para JupyterLab. Desde la versi\u00f3n 0.30.0b3 hasta la 0.54.0, el m\u00e9todo createHeader() de PlainTextDiff.ts pasa los nombres de archivo de Git directamente a innerHTML al renderizar archivos renombrados en el historial de commits, permitiendo que un nombre de archivo manipulado ejecute JavaScript cuando una v\u00edctima ve la diferencia de renombrado en la pesta\u00f1a Historial de Git. Este problema se ha corregido en la versi\u00f3n 0.54.0."}], "lastModified": "2026-10-25T17:10:00.197", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:jupyter:jupyterlab-git:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "560C0FF7-668A-4732-8F76-B228DFC68271", "versionEndExcluding": "0.54.0", "versionStartIncluding": "0.30.1"}, {"criteria": "cpe:2.3:a:jupyter:jupyterlab-git:0.30.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "12CEFD13-7386-4730-B44A-CD5974F52DB8"}, {"criteria": "cpe:2.3:a:jupyter:jupyterlab-git:0.30.0:beta3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6B743F45-F963-486F-8416-F795BC2F2609"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}