elyra (>=2.2.2, <=4.1.1), elyra-code-snippet-extension (>=1.3.0, <=4.1.1) +12 more potentially affected by CVE-2026-54527 via jupyterlab-git (>=0.30.0, <=0.52.0)

jupyterlab-git PYPI version =0.30.0, =2.2.2, =1.3.0, =3.14.0, =1.3.0, =1.3.0, =2.2.2, =3.14.0, =2.2.2, =0.4.0, =3.0.0b0, =0.1.30, =1.3.19, =0.1.0, =0.2.9 Source cves: CVE-2026-54527 Source advisory: OSV:PYSEC-2026-2540...

CVE-2026-54527

CVE-2026-54527 affects the jupyterlab-git extension. The PlainTextDiff.ts createHeader() renders renamed-file headers by directly inserting Git filenames into innerHTML, enabling stored XSS that can lead to remote code execution. Affected range is before 0.54.0, with fix released in 0.54.0. Explo...

fps-jupyterlab-git (>=0.3.0, <=0.3.1) potentially affected by CVE-2026-54527 via jupyterlab-git-core (0.53.0)

jupyterlab-git-core PYPI version 0.53.0 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab-git-core and may be impacted: - fps-jupyterlab-git =0.3.0, =0.3.1 Source cves: CVE-2026-54527 Source advisory: MEND:CVE-2026-54527...

@jupyterlab/pullrequests (>=2.0.0-alpha.0, <=3.0.2) potentially affected by CVE-2026-54527 via @jupyterlab/git (>=0.30.0, <=0.40.0)

@jupyterlab/git NPM version =0.30.0, =2.0.0-alpha.0, =3.0.2 Source cves: CVE-2026-54527 Source advisory: MEND:CVE-2026-54527...

elyra (>=2.2.2, <=4.1.1), elyra-code-snippet-extension (>=1.3.0, <=4.1.1) +12 more potentially affected by CVE-2026-54527 via jupyterlab-git (>=0.30.0, <=0.52.0)

jupyterlab-git PYPI version =0.30.0, =2.2.2, =1.3.0, =3.14.0, =1.3.0, =1.3.0, =2.2.2, =3.14.0, =2.2.2, =0.4.0, =3.0.0b0, =0.1.30, =1.3.19, =0.1.0, =0.2.9 Source cves: CVE-2026-54527 Source advisory: GHSA-F962-V9HR-PFG5...

fps-jupyterlab-git (>=0.3.0, <=0.3.1) potentially affected by CVE-2026-54527 via jupyterlab-git-core (0.53.0)

jupyterlab-git-core PYPI version 0.53.0 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab-git-core and may be impacted: - fps-jupyterlab-git =0.3.0, =0.3.1 Source cves: CVE-2026-54527 Source advisory: OSV:GHSA-F962-V9HR-PFG5...

@jupyterlab/pullrequests (>=2.0.0-alpha.0, <=3.0.2) potentially affected by CVE-2026-54527 via @jupyterlab/git (>=0.30.0, <=0.40.0)

@jupyterlab/git NPM version =0.30.0, =2.0.0-alpha.0, =3.0.2 Source cves: CVE-2026-54527 Source advisory: OSV:GHSA-F962-V9HR-PFG5...

CVE-2026-54527

creationtimestamp| type| source ---|---|--- 2026-06-18 07:12:58+00:00| published-proof-of-concept| https://github.com/jupyterlab/jupyterlab-git/security/advisories/GHSA-f962-v9hr-pfg5 2026-07-08 22:02:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq64oaqtfb24 2026-07-09...