JupyterLab Git is a Git extension for JupyterLab. From 0.30.0b3 before 0.54.0, the PlainTextDiff.ts createHeader() method passes Git filenames directly to innerHTML when rendering renamed files in commit history, allowing a crafted filename to execute JavaScript when a victim views the rename diff in the Git History tab. This issue is fixed in version 0.54.0.

JupyterLab Git extension for the JupyterLab platform. Versions from 0.30.0b3 up to, but not including, 0.54.0 are impacted. Affected builds include all publicly released releases in that range.

The CVSS score of 9.3 places this flaw in the critical range, indicating a high potential impact for confidentiality, integrity, and availability. The EPSS score of < 1% indicates a very low probability of exploitation, and the flaw is not in the CISA KEV catalog, suggesting it has not yet been widely exploited. The attack vector is likely a crafted repository containing a malicious filename; any user who opens the Git History tab for that repository will trigger the code. This path requires no elevated privileges beyond normal user access to the targeted JupyterLab instance, making exploitation considerably easy once the vulnerable extension is installed.