CVE-2026-54527 is a CWE-79 (Improper Neutralization of Input During Web Page Generation) vulnerability affecting jupyterlab-git, a Git extension for JupyterLab. Specifically, in versions from 0.30.0b3 up to but not including 0.54.0, the createHeader() method in PlainTextDiff.ts inserts Git filenames directly into innerHTML without sanitization when rendering renamed files in the commit history. This improper handling allows an attacker to execute arbitrary JavaScript code when a user views the rename diff in the Git History tab. The vulnerability has a CVSS 4.0 base score of 9.3, indicating critical severity. The issue is resolved in version 0.54.0.

An attacker can exploit this vulnerability by crafting a malicious Git filename that, when viewed in the Git History tab of jupyterlab-git, executes arbitrary JavaScript code in the context of the victim's browser. This can lead to actions such as session hijacking, data theft, or other malicious behaviors depending on the victim's privileges and environment. The vulnerability requires user interaction (viewing the rename diff) and low attack complexity, with no privileges required but user interaction needed. The impact on confidentiality, integrity, and availability is high.

This vulnerability is fixed in jupyterlab-git version 0.54.0. Users and administrators should upgrade to version 0.54.0 or later to remediate this issue. No other official remediation or temporary fixes are documented. Until upgrading, avoid viewing rename diffs from untrusted repositories or filenames.