JupyterLab Git is a Git extension for JupyterLab. From 0.30.0b3 before 0.54.0, the PlainTextDiff.ts createHeader() method passes Git filenames directly to innerHTML when rendering renamed files in commit history, allowing a crafted filename to execute JavaScript when a victim views the rename diff in the Git History tab. This issue is fixed in version 0.54.0.
Fix
Patch, vendor advisory and mitigation references on NVD 3
- https://github.com/jupyterlab/jupyterlab-git/commit/c6d37b88f36aa59aee317930b95e427fb9d6b09b Patch
- https://github.com/jupyterlab/jupyterlab-git/security/advisories/GHSA-f962-v9hr-pfg5 Exploit, Mitigation, Vendor Advisory
- https://github.com/jupyterlab/jupyterlab-git/security/advisories/GHSA-f962-v9hr-pfg5 Exploit, Mitigation, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 9.3 · jupyterNVD modified 2026-10-25 17:10
Affected (CPE criteria) 3
cpe:2.3:a:jupyter:jupyterlab-git:*:*:*:*:*:*:*:*cpe:2.3:a:jupyter:jupyterlab-git:0.30.0:-:*:*:*:*:*:*cpe:2.3:a:jupyter:jupyterlab-git:0.30.0:beta3:*:*:*:*:*:*
References 4
- https://github.com/jupyterlab/jupyterlab-git/commit/c6d37b88f36aa59aee317930b95e427fb9d6b09b Patch
- https://github.com/jupyterlab/jupyterlab-git/releases/tag/v0.54.0 Release Notes
- https://github.com/jupyterlab/jupyterlab-git/security/advisories/GHSA-f962-v9hr-pfg5 Exploit, Mitigation, Vendor Advisory
- https://github.com/jupyterlab/jupyterlab-git/security/advisories/GHSA-f962-v9hr-pfg5 Exploit, Mitigation, Vendor Advisory