CVE-2026-54527Critical· 9.0▾ MidnightA flaw was found in JupyterLab Git, a Git extension for JupyterLab. A remote attacker with commit access to a shared Git repository can exploit a stored cross-site scripting (XSS) vulnerability (CWE-79). By crafting a malicious Git filenam…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 49.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.4%
0.4% → 0.5%
Last analysed / modified upstream
— → 9
high → critical
A flaw was found in JupyterLab Git, a Git extension for JupyterLab. A remote attacker with commit access to a shared Git repository can exploit a stored cross-site scripting (XSS) vulnerability (CWE-79). By crafting a malicious Git filename, an attacker can execute arbitrary JavaScript in a victim's browser session when they view the rename diff in the Git History tab, potentially leading to remote code execution (RCE).
jupyterlab-git: jupyterlab-git-core: @jupyterlab/git: JupyterLab Git: Remote Code Execution via crafted Git filenames in commit history — rated Important by Red Hat. Released 2026-07-08, updated 2026-10-23.
Affected:
No fix planned:
Not affected:
Affected
Affected packages:
jupyterlab-git >= 0.30.0b3, < 0.54.0a1jupyterlab-git-core >= 0.30.0b3, < 0.54.0a1@jupyterlab/git >= 0.30.0b3, < 0.54.0-a1Patched in:
jupyterlab-git 0.54.0jupyterlab-git-core 0.54.0@jupyterlab/git 0.54.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115351Medium· 4.7mistune: mistune: Information disclosure via CSS injection in figure directive (CVE-2026-115351)
CVE-2026-115350Medium· 6.1mistune: mistune: Cross-site scripting via Include directive (CVE-2026-115350)
CVE-2026-114127Medium· 5.4astro: Astro: CSS injection via unvalidated view transition animation properties (CVE-2026-114127)
CVE-2026-114128Medium· 6.1astro: astro: Cross-Site Scripting via unescaped dynamic content in script and style elements (CVE-2026-114128)
CVE-2026-96640High· 7.5pillow: pillow: Denial of Service via duplicate page references in PDF files (CVE-2026-96640)
CVE-2026-114140High· 7.8nbconvert: nbconvert: arbitrary file write via path traversal in ExtractOutputPreprocessor (CVE-2026-114140)