Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.4

CVE-2026-54527: JupyterLab Git Extension: Malicious File Names Can Execute Code

GHSA-f962-v9hr-pfg5 CVE-2026-54527 CVE-2026-54527 CVE-2026-54527
Summary

The JupyterLab Git extension allows attackers to create malicious file names that can execute code when viewed by others. This can lead to unauthorized access to sensitive information or credentials. To protect yourself, update the JupyterLab Git extension to the latest version and ensure all users have the latest version installed. If you're a system administrator, consider restricting access to the Git History tab or disabling the JupyterLab Git extension if not in use.

What to do
  • Update jupyterlab-git to version 0.54.0.
  • Update jupyterlab-git-core to version 0.54.0.
  • Update jupyterlab git to version 0.54.0.
Affected software
Ecosystem VendorProductAffected versions
pip – jupyterlab-git >= 0.30.0b3, < 0.54.0a1
Fix: upgrade to 0.54.0
pip – jupyterlab-git-core >= 0.30.0b3, < 0.54.0a1
Fix: upgrade to 0.54.0
npm jupyterlab git >= 0.30.0b3, < 0.54.0-a1
Fix: upgrade to 0.54.0
– jupyterlab jupyterlab-git >= 0.30.0b3, < 0.54.0
Original title
JupyterLab Git: Stored XSS leading to RCE
Original description
JupyterLab Git is a Git extension for JupyterLab. From 0.30.0b3 before 0.54.0, the PlainTextDiff.ts createHeader() method passes Git filenames directly to innerHTML when rendering renamed files in commit history, allowing a crafted filename to execute JavaScript when a victim views the rename diff in the Git History tab. This issue is fixed in version 0.54.0.
ghsa CVSS4.0 8.6
Vulnerability type
CWE-79 Cross-site Scripting (XSS)
Published: 8 Jul 2026 · Updated: 23 Jul 2026 · First seen: 19 Jun 2026