CVE-2026-54527: JupyterLab Git XSS Vulnerability

CVE-2026-54527 Overview

CVE-2026-54527 is a stored cross-site scripting (XSS) vulnerability in JupyterLab Git, a Git extension for JupyterLab. The flaw exists in the PlainTextDiff.tscreateHeader() method, which passes Git filenames directly to innerHTML when rendering renamed files in commit history. An attacker who controls a filename in a Git repository can craft a rename that embeds JavaScript, which executes in the victim's browser context when the victim opens the rename diff in the Git History tab. Affected versions range from 0.30.0b3 up to but not including 0.54.0. The issue is fixed in version 0.54.0.

Critical Impact
A crafted filename in a Git repository can execute arbitrary JavaScript in a JupyterLab session, enabling session hijacking, code execution in notebooks, and lateral movement across the JupyterLab environment.

Affected Products

JupyterLab Git extension versions 0.30.0b3 through 0.53.x
JupyterLab environments with the vulnerable jupyterlab-git extension installed
Shared or multi-user JupyterLab deployments that expose Git History views

Discovery Timeline

2026-07-08 - CVE-2026-54527 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-54527

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw classified under [CWE-79]. JupyterLab Git renders commit history diffs in the front-end using TypeScript. When a commit contains a renamed file, the createHeader() method in PlainTextDiff.ts builds a header element that displays the old and new filenames. The implementation assigns the filenames directly to the innerHTML property of a DOM node without escaping HTML entities or sanitizing markup.

Git permits nearly arbitrary byte sequences in filenames, so an attacker can commit a file whose name contains HTML tags such as <img src=x onerror=...>. When a JupyterLab user later browses the commit history and opens the rename diff, the browser parses the malicious markup and executes the embedded script under the JupyterLab origin. The attack requires only that the victim views the rename entry, and it inherits the victim's authenticated JupyterLab session.

Root Cause

The root cause is unsafe DOM sink usage. The createHeader() function concatenates untrusted filename strings from Git metadata into an HTML string that is then written to innerHTML. No output encoding, textContent assignment, or DOM sanitization library is applied. Git filenames must be treated as attacker-controlled input in any application that displays repository contents.

Attack Vector

An attacker commits a file with a crafted filename to a repository that a JupyterLab user will clone, pull, or open. The attacker then renames the file in a subsequent commit, producing a rename entry in the history. When the victim opens the Git History tab in JupyterLab and expands the rename diff, the payload executes. Delivery paths include pull requests to shared repositories, malicious upstream repositories, and shared notebooks distributed with a Git history.

javascript

// Conceptual illustration of the vulnerable sink pattern
// (no working exploit code was published with the advisory)
function createHeader(oldName, newName) {
  const el = document.createElement('div');
  // Vulnerable: filenames from Git are inserted as HTML
  el.innerHTML = `Renamed: ${oldName} -> ${newName}`;
  return el;
}
// A filename such as `evil<img src=x onerror=alert(1)>.txt`
// would execute JavaScript when rendered.

Detection Methods for CVE-2026-54527

Indicators of Compromise

Git repository entries containing filenames with HTML metacharacters such as <, >, ", or event handler substrings like onerror=, onload=, or onclick=
Rename operations in commit history where the old or new filename contains <script> tags or SVG/image tags
Unexpected outbound HTTP requests originating from a JupyterLab browser tab immediately after opening the Git History view
JupyterLab session token or cookie access from unfamiliar user agents shortly after a repository pull

Detection Strategies

Inspect git log --name-status --diff-filter=R output for renamed paths whose names contain HTML or JavaScript syntax
Scan repository mirrors and CI artifacts for filenames matching regular expressions such as [<>"']|on[a-z]+= before importing them into interactive environments
Review installed jupyterlab-git versions across JupyterHub deployments and flag any version between 0.30.0b3 and 0.53.x
Monitor JupyterLab web server access logs for anomalous XHR or fetch activity that follows a Git History view request

Monitoring Recommendations

Enforce a Content Security Policy (CSP) on JupyterLab that blocks inline script execution, and alert on CSP violation reports
Log and centralize browser-side error and CSP reports from JupyterLab sessions for retrospective hunting
Track version inventory of JupyterLab extensions using package management telemetry to detect drift back to vulnerable releases

How to Mitigate CVE-2026-54527

Immediate Actions Required

Upgrade jupyterlab-git to version 0.54.0 or later on every JupyterLab and JupyterHub deployment
Audit shared and multi-tenant JupyterLab environments to confirm no user has a vulnerable version installed in a personal environment
Restrict which Git remotes users can clone from within managed JupyterLab instances until upgrades are verified
Rotate JupyterLab session tokens and API keys if repositories containing suspicious filenames were opened on vulnerable versions

Patch Information

The fix is available in JupyterLab Git version 0.54.0. Details are published in the GitHub Security Advisory GHSA-f962-v9hr-pfg5, the GitHub Release v0.54.0, and the remediation commit. The patch changes the header rendering path so filenames are no longer inserted through innerHTML.

Workarounds

Disable the jupyterlab-git extension until it can be upgraded, using jupyter labextension disable @jupyterlab/git
Instruct users to avoid opening the Git History tab on untrusted repositories on vulnerable versions
Apply a strict Content Security Policy on JupyterLab that blocks inline scripts and event handler attributes

bash

# Upgrade jupyterlab-git to the patched release
pip install --upgrade 'jupyterlab-git>=0.54.0'

# Verify installed version
jupyter labextension list | grep jupyterlab-git

# Temporary workaround: disable the extension
jupyter labextension disable @jupyterlab/git