JavaScript Execution Vulnerability in JupyterLab Git

CVE-2026-54527

What is CVE-2026-54527?

The JupyterLab Git extension contains a vulnerability that affects versions from 0.30.0b3 up to 0.54.0. The issue arises from the createHeader() method in PlainTextDiff.ts, which improperly handles Git filenames by passing them directly to innerHTML when rendering renamed files in the commit history. This flaw allows an attacker to craft a filename that executes arbitrary JavaScript when the victim views the corresponding rename diff in the Git History tab. Users are encouraged to upgrade to version 0.54.0, where this vulnerability has been addressed.

References