| Title | github jupyterlab-git Release-v1.9_cuda-12.6_ubuntu-24.04 https://github.com/iot-salzburg/gpu-jupyter/blob/20efdb2e9a3f4f0 |
|---|
| Description | # Stored XSS leading to Remote Code Execution Vulnerability in `gpu-jupyter`
A stored cross-site scripting (XSS) vulnerability leading to remote code execution (RCE) exists in the `gpu-jupyter` project version `Release-v1.9_cuda-12.6_ubuntu-24.04`.
[`gpu-jupyter`](https://github.com/iot-salzburg/gpu-jupyter) : GPU-accelerated JupyterLab with PyTorch, TensorFlow, and a rich data science toolstack for reproducible deep learning experiments. Docker Hub pulls: 505,000+.
The project pins a vulnerable version of `jupyterlab-git==0.51.0` in line `541` of the `.build/Dockerfile`. This version contains a stored XSS vulnerability (CVE-2026-54527) in the `PlainTextDiff.ts` component. The `createHeader()` method at line `221` passes Git filenames directly to `innerHTML` without sanitization when rendering diffs for renamed files in commit history. Since git allows arbitrary characters in filenames (including HTML/JavaScript), an attacker can craft a filename containing malicious JavaScript that executes when another user views the rename diff in the Git History tab.
Because gpu-jupyter runs JupyterLab as `root` with full kernel access, the XSS can escalate to Remote Code Execution by calling the Jupyter Kernel API from the browser context — starting a kernel and executing arbitrary OS commands on the server.
In the vulnerability replication environment, a Docker container running the same `jupyterlab-git==0.51.0` version as gpu-jupyter is used. A malicious git repository with a crafted rename commit triggers the XSS when viewing the diff. |
|---|
| Source | ⚠️ https://github.com/jiy2020/Stored-XSS-leading-to-Remote-Code-Execution-Vulnerability-in-gpu-jupyter- |
|---|
| User | CLJY (UID 46916) |
|---|
| Submission | 06/30/2026 03:45 (28 days ago) |
|---|
| Moderation | 07/26/2026 18:04 (27 days later) |
|---|
| Status | Duplicate |
|---|
| VulDB entry | 377029 [jupyterlab Git Plugin up to 0.53.x Git History Tab PlainTextDiff.ts createHeader filename cross site scripting] |
|---|
| Points | 0 |
|---|