CyberRota Analysis
AI-GeneratedJupyterLab Git versions from 0.30.0b3 to 0.54.0 are vulnerable due to improper handling of Git filenames in the PlainTextDiff.ts createHeader() method, which can lead to cross-site scripting (XSS) attacks when users view renamed files in the commit history. This critical vulnerability allows an attacker to execute arbitrary JavaScript in the context of the victim's browser, potentially compromising sensitive data or user sessions. Organizations using affected versions should prioritize updating to version 0.54.0 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
JupyterLab Git is a Git extension for JupyterLab. From 0.30.0b3 before 0.54.0, the PlainTextDiff.ts createHeader() method passes Git filenames directly to innerHTML when rendering renamed files in commit history, allowing a crafted filename to execute JavaScript when a victim views the rename diff in the Git History tab. This issue is fixed in version 0.54.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)