GHSA-f962-v9hr-pfg5Published

jupyterlab-git extension: Stored XSS leading to RCE

Exact source revision recorded 24 Oct 2026 13:17:17 UTC. It does not establish the source's current position. Latest evidence.

Recorded JSON

osv · GHSA-f962-v9hr-pfg5

Published

jupyterlab-git

PyPI

ECOSYSTEM · introduced 0.30.0b3 → fixed 0.54.0

48 explicitly affected versions

0.30.0, 0.30.0b3, 0.30.1, 0.31.0, 0.31.0a0, 0.32.0, 0.32.1, 0.32.2, 0.32.3, 0.32.4, 0.33.0, 0.34.0, 0.34.1, 0.34.2, 0.35.0, 0.36.0, 0.37.0, 0.37.1, 0.38.0, 0.39.0, 0.39.1, 0.39.2, 0.39.3, 0.40.0, 0.40.1, 0.41.0, 0.42.0, 0.42.0rc0, 0.43.0, 0.44.0, 0.50.0, 0.50.0a0, 0.50.0a1, 0.50.0a2, 0.50.0rc0, 0.50.1, 0.50.2, 0.51.0, 0.51.1, 0.51.2, 0.51.3, 0.51.4, 0.52.0, 0.53.0, 0.53.0a0, 0.53.0a1, 0.54.0a0, 0.54.0a1

jupyterlab-git-core

PyPI

ECOSYSTEM · introduced 0.30.0b3 → fixed 0.54.0

4 explicitly affected versions

0.53.0, 0.53.0a1, 0.54.0a0, 0.54.0a1

@jupyterlab/git

npm

SEMVER · introduced 0.30.0-beta.3 → fixed 0.54.0

Original source record · Cite this exact observation · Complete original publisher JSON