Threat Advisory

jupyterlab-git Vulnerability Allows Filename HTML Injection

Threat: Vulnerability
Targeted Region: Global
Targeted Sector: Technology & IT
Criticality: High
[subscribe_to_unlock_form]

EXECUTIVE SUMMARY:

Multiple security vulnerabilities have been identified in the jupyterlab-git extension for JupyterLab (pip packages jupyterlab-git and jupyterlab-git-core, and npm @jupyterlab/git) affecting versions from 0.30.0b3 up to, but not including, 0.54.0a1. The flaws include a stored cross‑site scripting issue that can be chained to remote code execution, and a case‑sensitivity bypass that allows unauthorized reading of files designated as excluded. Both weaknesses enable an attacker with repository commit access or authenticated server access to execute arbitrary JavaScript in a victim’s browser session or to retrieve confidential repository data, potentially compromising secrets, credentials, and internal code integrity.[/subscribe_to_unlock_form]

EXECUTIVE SUMMARY:

Multiple security vulnerabilities have been identified in the jupyterlab-git extension for JupyterLab (pip packages jupyterlab-git and jupyterlab-git-core, and npm @jupyterlab/git) affecting versions from 0.30.0b3 up to, but not including, 0.54.0a1. The flaws include a stored cross‑site scripting issue that can be chained to remote code execution, and a case‑sensitivity bypass that allows unauthorized reading of files designated as excluded. Both weaknesses enable an attacker with repository commit access or authenticated server access to execute arbitrary JavaScript in a victim’s browser session or to retrieve confidential repository data, potentially compromising secrets, credentials, and internal code integrity.[emaillocker id="1283"]

  • CVE-2026-54527 with a CVSS score of 7.5 – stored XSS in PlainTextDiff.ts that allows an attacker with commit rights to inject malicious filenames, which execute when a victim views the rename diff, leading to arbitrary JavaScript execution and subsequent remote code execution via the JupyterLab terminal API.
  • CVE-2026-54528 with a CVSS score of 7.1 – case‑sensitivity bypass in excluded_paths enforcement that lets an authenticated user on case‑insensitive filesystems craft path strings with altered case to read files and git metadata that the administrator intended to hide.

These vulnerabilities expose JupyterLab deployments to credential theft, unauthorized code execution, and leakage of sensitive repository data, posing immediate threats to data confidentiality and system integrity. Organizations should treat the findings as high priority, as exploitation requires only limited access and can be performed remotely through standard user interactions. Failure to address them could result in loss of proprietary information, compliance violations, and disruption of critical analytics workflows.

RECOMMENDATION:

  • We recommend you to update jupyterlab-git to version 0.54.0.

REFERENCES:

The following reports contain further technical details:
https://github.com/advisories/GHSA-f962-v9hr-pfg5
https://github.com/advisories/GHSA-436q-jwfr-rm2h

[/emaillocker]
crossmenu