jupyterlab-git: crafted filename in a rename diff executes JavaScript in the notebook user's browser

Impact

A Git filename is passed to innerHTML when the Git History tab renders a renamed file, so a repository containing a crafted filename runs attacker JavaScript in the context of the JupyterLab session that opens it. On a shared GPU box or a multi-user JupyterHub, that session holds the user's Jupyter token and can drive the kernel API, which means code execution on the GPU node as that user and access to whatever data and mounted model storage their pods reach. The trigger is a user action - someone viewing the rename diff of a cloned or shared repo - so it spreads through ordinary collaboration on notebooks rather than through any exposed network service. Fixed in 0.54.0; versions 0.30.0b3 through 0.53.x are affected.

Who can reach it

Anyone who can get a repository with a crafted filename in front of a JupyterLab user - a shared clone, a pull request branch, a repo on shared storage. Requires the victim to open the Git History tab and view the rename diff; no attacker authentication to the Jupyter server is needed.

What to do

Upgrade the jupyterlab-git extension to 0.54.0 and restart each JupyterLab server so the new frontend assets load. On a JupyterHub fleet this means rebuilding the singleuser image and cycling user servers; no host reboot or node drain is required, but running notebook sessions must be restarted to pick up the fix.

References

Related entries

• LLaMA-Factory: model path in the WebUI loads remote code and executes it as the training server processCVE-2026-58116 · LLaMA-Factory WebUI (model path -> from_pretrained with trust_remote_code=True)Critical
• ktransformers: unauthenticated pickle deserialization on the scheduler ZMQ socket gives RCE as the server processCVE-2026-63767 · ktransformers SchedulerServer (ZMQ ROUTER socket)Critical
• MLflow: unauthenticated webhook test follows redirects, turning the tracking server into an SSRF proxyCVE-2026-64849 · MLflow tracking server (webhook test endpoint, /api/2.0/mlflow/webhooks/{id}/test)Critical
• sentence-transformers: local model directory executes Python despite trust_remote_code=FalseCVE-2026-68770 · sentence-transformers (import_module_class trust_remote_code gate)Critical
• Langchain-Chatchat: unauthenticated /tools/call invokes the shell tool for remote command executionCVE-2026-75128 · Langchain-Chatchat (POST /tools/call API endpoint)Critical
• LMDeploy: unauthenticated p2p endpoints let a remote peer deliver a pickle payload for engine RCECVE-2026-76850 · LMDeploy (disaggregated serving ZMQ peer channel)Critical