{"id":"EUVD-2026-42428","enisaUuid":"982e96be-5b4b-3e2f-8c43-4cfdc4942714","description":"JupyterLab Git is a Git extension for JupyterLab. From 0.30.0b3 before 0.54.0, the PlainTextDiff.ts createHeader() method passes Git filenames directly to innerHTML when rendering renamed files in commit history, allowing a crafted filename to execute JavaScript when a victim views the rename diff in the Git History tab. This issue is fixed in version 0.54.0.","datePublished":"Jul 8, 2026, 9:03:01 PM","dateUpdated":"Jul 9, 2026, 2:16:09 PM","baseScore":9.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","references":"https://github.com/jupyterlab/jupyterlab-git/security/advisories/GHSA-f962-v9hr-pfg5\nhttps://github.com/jupyterlab/jupyterlab-git/commit/c6d37b88f36aa59aee317930b95e427fb9d6b09b\nhttps://github.com/jupyterlab/jupyterlab-git/releases/tag/v0.54.0\n","aliases":"CVE-2026-54527\nGHSA-f962-v9hr-pfg5\n","assigner":"GitHub_M","epss":0.53,"enisaIdProduct":[{"id":"b6bab1d2-57b4-3bd8-951a-bb33f4a345ef","product":{"name":"jupyterlab-git","vendor":{"name":"jupyterlab"}},"product_version":"0.30.0b3, \u003c 0.54.0"}],"enisaIdVendor":[{"id":"1f91a0a4-d5e3-3407-a22f-712fdb4230a7","vendor":{"name":"jupyterlab"}}],"enisaIdVulnerability":[{"id":"7eb57085-5f31-3917-b127-959f79a55cd0","vulnerability":{"id":"CVE-2026-54527","description":"JupyterLab Git is a Git extension for JupyterLab. From 0.30.0b3 before 0.54.0, the PlainTextDiff.ts createHeader() method passes Git filenames directly to innerHTML when rendering renamed files in commit history, allowing a crafted filename to execute JavaScript when a victim views the rename diff in the Git History tab. This issue is fixed in version 0.54.0.","datePublished":"Jul 8, 2026, 9:03:01 PM","dateUpdated":"Jul 9, 2026, 2:16:09 PM","status":"PUBLISHED","baseScore":9.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","references":"https://github.com/jupyterlab/jupyterlab-git/security/advisories/GHSA-f962-v9hr-pfg5\nhttps://github.com/jupyterlab/jupyterlab-git/commit/c6d37b88f36aa59aee317930b95e427fb9d6b09b\nhttps://github.com/jupyterlab/jupyterlab-git/releases/tag/v0.54.0\n","enisa_id":"EUVD-2026-42428\n","assigner":"GitHub_M","epss":0.53,"dataProcessed":"Nov 7, 2026, 7:20:15 AM","vulnerabilityProduct":[{"id":"50cd0f63-9a8f-34ee-ac10-b0fc8d79ccc5","product":{"name":"jupyterlab-git","vendor":{"name":"jupyterlab"}},"product_version":"0.30.0b3, \u003c 0.54.0"}],"vulnerabilityVendor":[{"id":"90dbdd8a-07d7-3fd0-b29a-b2d7ac04c819","vendor":{"name":"jupyterlab"}}]}},{"id":"85aa2c73-7666-3466-a1fa-7da43c23fe19","vulnerability":{"id":"PYSEC-2026-2540","description":"jupyterlab-git extension: Stored XSS leading to RCE","datePublished":"Jul 13, 2026, 3:46:21 PM","dateUpdated":"Jul 13, 2026, 4:04:23 PM","baseScore":0.0,"references":"https://github.com/jupyterlab/jupyterlab-git/security/advisories/GHSA-f962-v9hr-pfg5\nhttps://github.com/jupyterlab/jupyterlab-git\nhttps://pypi.org/project/jupyterlab-git\nhttps://github.com/advisories/GHSA-f962-v9hr-pfg5\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-54527\n","enisa_id":"EUVD-2026-42428\n","aliases":"CVE-2026-54527\nGHSA-f962-v9hr-pfg5\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:17:12 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"97f8f0d5-c1e9-3426-9d96-f96b9660e498","vulnerability":{"id":"PYSEC-2026-2541","description":"jupyterlab-git extension: Stored XSS leading to RCE","datePublished":"Jul 13, 2026, 3:46:21 PM","dateUpdated":"Jul 13, 2026, 4:04:23 PM","baseScore":0.0,"references":"https://github.com/jupyterlab/jupyterlab-git/security/advisories/GHSA-f962-v9hr-pfg5\nhttps://github.com/jupyterlab/jupyterlab-git\nhttps://pypi.org/project/jupyterlab-git-core\nhttps://github.com/advisories/GHSA-f962-v9hr-pfg5\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-54527\n","enisa_id":"EUVD-2026-42428\n","aliases":"CVE-2026-54527\nGHSA-f962-v9hr-pfg5\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:17:12 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"eab4cf70-0549-3945-b835-095206888445","vulnerability":{"id":"GHSA-f962-v9hr-pfg5","description":"jupyterlab-git extension: Stored XSS leading to RCE","datePublished":"Jun 19, 2026, 7:36:04 PM","dateUpdated":"Sep 4, 2026, 9:16:43 PM","baseScore":0.0,"references":"https://github.com/jupyterlab/jupyterlab-git/security/advisories/GHSA-f962-v9hr-pfg5\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-54527\nhttps://github.com/jupyterlab/jupyterlab-git/commit/c6d37b88f36aa59aee317930b95e427fb9d6b09b\nhttps://github.com/advisories/GHSA-f962-v9hr-pfg5\nhttps://github.com/jupyterlab/jupyterlab-git\nhttps://github.com/jupyterlab/jupyterlab-git/releases/tag/v0.54.0\nhttps://github.com/pypa/advisory-database/tree/main/vulns/jupyterlab-git-core/PYSEC-2026-2541.yaml\nhttps://github.com/pypa/advisory-database/tree/main/vulns/jupyterlab-git/PYSEC-2026-2540.yaml\nhttps://pypi.org/project/jupyterlab-git\nhttps://pypi.org/project/jupyterlab-git-core\n","enisa_id":"EUVD-2026-42428\n","aliases":"CVE-2026-54527\nGHSA-f962-v9hr-pfg5\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}