{"id":"GHSA-f962-v9hr-pfg5","revision":null,"records":[{"revision":"15f3593feef242a39955674f3567c6f1","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-54527","aliases":[],"title":"JupyterLab Git: Stored XSS leading to RCE","description":"JupyterLab Git is a Git extension for JupyterLab. From 0.30.0b3 before 0.54.0, the PlainTextDiff.ts createHeader() method passes Git filenames directly to innerHTML when rendering renamed files in commit history, allowing a crafted filename to execute JavaScript when a victim views the rename diff in the Git History tab. This issue is fixed in version 0.54.0.","state":0,"publishedAt":"2026-07-08T21:03:01.698+00:00","modifiedAt":"2026-07-09T14:16:09.781+00:00","affected":[{"ecosystem":"Vendor product","name":"jupyterlab-git","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"jupyterlab\",\n                    \"product\": \"jupyterlab-git\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 0.30.0b3, < 0.54.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","score":9.3,"severity":"CRITICAL"}],"references":["https://github.com/jupyterlab/jupyterlab-git/security/advisories/GHSA-f962-v9hr-pfg5","https://github.com/jupyterlab/jupyterlab-git/commit/c6d37b88f36aa59aee317930b95e427fb9d6b09b","https://github.com/jupyterlab/jupyterlab-git/releases/tag/v0.54.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-54527","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-54527","identifiers":["CVE-2026-54527"]},"retained":false,"historicalAffected":[]},{"revision":"0f6668d6153a450fbfbe8740a05d1d7d","observedAt":"2026-11-07T12:30:05.795+00:00","statement":{"source":"euvd","id":"EUVD-2026-42428","aliases":["CVE-2026-54527","GHSA-f962-v9hr-pfg5"],"title":"JupyterLab Git is a Git extension for JupyterLab. From 0.30.0b3 before 0.54.0, the PlainTextDiff.ts createHeader() method passes Git filenames directly to innerHTML when rendering renamed files in commit history, allowing a crafted filename…","description":"JupyterLab Git is a Git extension for JupyterLab. From 0.30.0b3 before 0.54.0, the PlainTextDiff.ts createHeader() method passes Git filenames directly to innerHTML when rendering renamed files in commit history, allowing a crafted filename to execute JavaScript when a victim views the rename diff in the Git History tab. This issue is fixed in version 0.54.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","score":9.3,"severity":null}],"references":["https://github.com/jupyterlab/jupyterlab-git/security/advisories/GHSA-f962-v9hr-pfg5","https://github.com/jupyterlab/jupyterlab-git/commit/c6d37b88f36aa59aee317930b95e427fb9d6b09b","https://github.com/jupyterlab/jupyterlab-git/releases/tag/v0.54.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42428","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jul 8, 2026, 9:03:01 PM","dateUpdated":"Jul 9, 2026, 2:16:09 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-42428","identifiers":["EUVD-2026-42428","CVE-2026-54527","GHSA-f962-v9hr-pfg5"]},"retained":false,"historicalAffected":[]},{"revision":"234e1aad30c44a21b9cd1fd9f48e48ec","observedAt":"2026-10-27T14:13:32.924+00:00","statement":{"source":"nvd","id":"CVE-2026-54527","aliases":[],"title":"JupyterLab Git is a Git extension for JupyterLab. From 0.30.0b3 before 0.54.0, the PlainTextDiff.ts createHeader() method passes Git filenames directly to innerHTML when rendering renamed files in commit history, allowing a crafted filename…","description":"JupyterLab Git is a Git extension for JupyterLab. From 0.30.0b3 before 0.54.0, the PlainTextDiff.ts createHeader() method passes Git filenames directly to innerHTML when rendering renamed files in commit history, allowing a crafted filename to execute JavaScript when a victim views the rename diff in the Git History tab. This issue is fixed in version 0.54.0.","state":0,"publishedAt":"2026-07-08T21:16:49.273+00:00","modifiedAt":"2026-10-25T17:10:00.197+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":9.3,"severity":"CRITICAL"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","score":9,"severity":"CRITICAL"}],"references":["https://github.com/jupyterlab/jupyterlab-git/commit/c6d37b88f36aa59aee317930b95e427fb9d6b09b","https://github.com/jupyterlab/jupyterlab-git/releases/tag/v0.54.0","https://github.com/jupyterlab/jupyterlab-git/security/advisories/GHSA-f962-v9hr-pfg5"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54527","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-79"],"productCriteria":["cpe:2.3:a:jupyter:jupyterlab-git:*:*:*:*:*:*:*:*","cpe:2.3:a:jupyter:jupyterlab-git:0.30.0:-:*:*:*:*:*:*","cpe:2.3:a:jupyter:jupyterlab-git:0.30.0:beta3:*:*:*:*:*:*"],"sourceDates":{"published":"2026-07-08T21:16:49.273","lastModified":"2026-10-25T17:10:00.197"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-54527","identifiers":["CVE-2026-54527"]},"retained":false,"historicalAffected":[]},{"revision":"8dacb4760a2340b19fdaacf93efe0113","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-f962-v9hr-pfg5","aliases":["CVE-2026-54527","PYSEC-2026-2540","PYSEC-2026-2541"],"title":"jupyterlab-git extension: Stored XSS leading to RCE","description":"Overview\n\nAmazon Web Services (AWS) Security has identified a stored cross-site scripting (XSS) issue in the jupyterlab-git JupyterLab extension that can lead to remote code execution (RCE). The issue exists in the\u00A0PlainTextDiff.ts component, where the createHeader() method passes Git filenames directly to innerHTML without sanitization when rendering diffs for renamed files in commit history. This allows an adversary to\u00A0craft a filename containing arbitrary HTML/JavaScript that executes when another user views the rename diff in the Git History tab.\n\nThe issue can be leveraged through the rename history view in the JupyterLab Git panel. An adversary creates a file with a crafted filename containing a JavaScript payload (e.g.,\u00A0<img src=x onerror=eval(atob(\"base64_payload\"))>.py), renames the file in a subsequent commit, and pushes to a shared repository. When a victim clones the repository, navigates to the Git History tab, clicks the\u00A0rename commit, and then clicks the renamed file to view the diff, the unsanitized filename renders via innerHTML, executing arbitrary JavaScript in the victim's browser session. The injected JavaScript reads the\u00A0xsrf cookie, opens a JupyterLab terminal via POST /api/terminals, connects via WebSocket, and executes arbitrary shell commands — achieving full RCE. An adversary can leverage this to exfiltrate secrets or\u00A0credentials from the victim's environment.\n\n\n\nScope of impact\n\nWe discovered this issue during internal security testing. The issue is present in the default configuration of JupyterLab when the jupyterlab-git extension is installed.\n\nThe attack requires:\n\n- The adversary to have commit access to a Git repository that the victim has cloned\n\n- The victim to navigate to the Git History tab, click the rename commit, and\u00A0click the renamed file to view the diff\n\n\n\nThe issue could allow an actor who has access to a shared Git repository to execute arbitrary JavaScript in another user's JupyterLab environment by committing a file with a crafted filename, potentially leading to remote code execution with access to user code, data, environment variables, and credentials.\n\n\n\nProof of concept\n\nThe issue exists in the createHeader() method where filenames from rename history are passed directly to innerHTML without sanitization:\n\n[1] https://github.com/jupyterlab/jupyterlab-git/blob/main/src/components/diff/PlainTextDiff.ts#L214\n\n\n\nAttack flow:\n\n1. An adversary creates a file with a crafted filename containing a JavaScript payload, e.g., <img src=x onerror=eval(atob(\"base64_payload\"))>.py\n\n2. The adversary renames the file in a subsequent commit and pushes both commits to a shared Git repository\n\n3. The victim clones or pulls the repository and navigates to the Git History tab in JupyterLab\n\n4. The victim clicks the rename commit, then clicks the renamed file to view the diff\n\n5. The createHeader() method constructs a diff header using string concatenation with the unsanitized filename and assigns the result to innerHTML\n\n6. The injected JavaScript executes in the victim's browser session, reads the _xsrf cookie, sends a POST request to /api/terminals to open a JupyterLab terminal, connects via WebSocket, and executes arbitrary\u00A0shell commands\n\n\n\nProof-of-concept mitigation\n\nThe issue can be mitigated by replacing innerHTML with textContent for filename rendering in the createHeader() method of PlainTextDiff.ts. Alternatively, proper HTML sanitization (escaping <, >, &, \", ') can be\u00A0applied before inserting user-controlled filenames into the DOM.","state":0,"publishedAt":"2026-06-19T19:36:04+00:00","modifiedAt":"2026-09-04T21:30:06.6673071+00:00","affected":[{"ecosystem":"PyPI","name":"jupyterlab-git","ranges":[{"type":"ECOSYSTEM","events":[{"kind":"introduced","version":"0.30.0b3"},{"kind":"fixed","version":"0.54.0"}]}],"versions":["0.30.0","0.30.0b3","0.30.1","0.31.0","0.31.0a0","0.32.0","0.32.1","0.32.2","0.32.3","0.32.4","0.33.0","0.34.0","0.34.1","0.34.2","0.35.0","0.36.0","0.37.0","0.37.1","0.38.0","0.39.0","0.39.1","0.39.2","0.39.3","0.40.0","0.40.1","0.41.0","0.42.0","0.42.0rc0","0.43.0","0.44.0","0.50.0","0.50.0a0","0.50.0a1","0.50.0a2","0.50.0rc0","0.50.1","0.50.2","0.51.0","0.51.1","0.51.2","0.51.3","0.51.4","0.52.0","0.53.0","0.53.0a0","0.53.0a1","0.54.0a0","0.54.0a1"],"rawVersionEvidence":null},{"ecosystem":"PyPI","name":"jupyterlab-git-core","ranges":[{"type":"ECOSYSTEM","events":[{"kind":"introduced","version":"0.30.0b3"},{"kind":"fixed","version":"0.54.0"}]}],"versions":["0.53.0","0.53.0a1","0.54.0a0","0.54.0a1"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@jupyterlab/git","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.30.0-beta.3"},{"kind":"fixed","version":"0.54.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","score":null,"severity":null},{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/jupyterlab/jupyterlab-git/security/advisories/GHSA-f962-v9hr-pfg5","https://nvd.nist.gov/vuln/detail/CVE-2026-54527","https://github.com/jupyterlab/jupyterlab-git/commit/c6d37b88f36aa59aee317930b95e427fb9d6b09b","https://github.com/advisories/GHSA-f962-v9hr-pfg5","https://github.com/jupyterlab/jupyterlab-git","https://github.com/jupyterlab/jupyterlab-git/releases/tag/v0.54.0","https://github.com/pypa/advisory-database/tree/main/vulns/jupyterlab-git-core/PYSEC-2026-2541.yaml","https://github.com/pypa/advisory-database/tree/main/vulns/jupyterlab-git/PYSEC-2026-2540.yaml","https://pypi.org/project/jupyterlab-git","https://pypi.org/project/jupyterlab-git-core"],"sourceUrl":"https://github.com/advisories/GHSA-f962-v9hr-pfg5","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-f962-v9hr-pfg5","identifiers":["GHSA-f962-v9hr-pfg5","CVE-2026-54527","PYSEC-2026-2540","PYSEC-2026-2541"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-07T21:52:16.7895348+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-07T21:52:16.7895348+00:00","lastSuccessAt":"2026-11-07T21:52:17.018923+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:17.0189237+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-bb5c9d5a08063ef076042e33dd72a7d0ffa4c4487efdcf3106e29ba55ec2ad57-5978693a555a2fac0feee4f8e1cdc5e013b9a91b16046d4e34ae63a3d3db8d19","complete":true,"records":420947,"lastAttemptAt":"2026-11-07T21:52:16.4606105+00:00","lastSuccessAt":"2026-11-07T21:52:16.3995215+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:16.4606105+00:00","snapshotPublishedAt":"2026-11-07T21:18:20+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-c91a0736a9624a48aebf081ca5dd86b2","complete":true,"records":13633,"lastAttemptAt":"2026-11-07T22:04:27.1191985+00:00","lastSuccessAt":"2026-11-07T22:04:27.115+00:00","error":null,"lastVerifiedAt":"2026-11-07T22:04:27.115+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-07T21:52:16.7895348+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-07T21:52:16.7895348+00:00","lastSuccessAt":"2026-11-07T21:52:17.0199092+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:17.0199095+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-2b22c2d15f834007aa54c93f73b8deaf","complete":true,"records":13645,"lastAttemptAt":"2026-11-07T21:52:42.2590883+00:00","lastSuccessAt":"2026-11-07T21:52:42.255+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:42.255+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-07T21:52:16.7352005+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:16.7352005+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-07T21:52:16.5087916+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:16.5087916+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-07T21:52:16.7531721+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:16.7531721+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-40ad6183a951565ace1520a9b4d631e1d0bfb1d4bf7c5574c375032559f3ff53","complete":true,"records":231292,"lastAttemptAt":"2026-11-07T21:52:16.6283313+00:00","lastSuccessAt":"2026-11-07T10:29:00.4821259+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:16.6283313+00:00","snapshotPublishedAt":"2026-11-07T09:32:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}