JupyterLab Git is a Git extension for JupyterLab. From 0.30.0b3 before 0.54.0, the PlainTextDiff.ts createHeader() method passes Git filenames directly to innerHTML when rendering renamed files in commit history, allowing a crafted filename to execute JavaScript when a victim views the rename diff in the Git History tab. This vulnerability is a Stored Cross‑Site Scripting (XSS) flaw classified as CWE‑79, which permits malicious script to run within the victim's browser context, compromising confidentiality, integrity, and availability of the session.

JupyterLab Git extension for the JupyterLab platform. Versions from 0.30.0b3 up to, but not including, 0.54.0 are impacted. Affected builds include all publicly released releases in that range.

The CVSS score of 9.3 places this flaw in the critical range, indicating a high potential impact for confidentiality, integrity, and availability. The EPSS score of < 1% indicates a very low probability of exploitation, and the flaw is not in the CISA KEV catalog, suggesting it has not yet been widely exploited. The likely attack vector is a crafted repository containing a malicious filename; any user who opens the Git History tab for that repository will trigger the code. This path requires no elevated privileges beyond normal user access to the targeted JupyterLab instance, making exploitation considerably easy once the vulnerable extension is installed.