@jupyterlab/git@0.54.0-a0

@jupyterlab/git is an A JupyterLab extension for version control using git

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) in the createHeader method. An attacker can execute arbitrary JavaScript in another user's browser session by crafting a malicious filename containing a JavaScript payload, committing and renaming the file in a shared Git repository, and having the victim view the rename diff in the Git History tab. This can lead to the execution of arbitrary shell commands, exfiltration of secrets, or credentials from the victim's environment.

Note: This is only exploitable if the attacker has commit access to a Git repository that the victim clones and the victim navigates to the Git History tab, clicks the rename commit, and views the diff of the renamed file.

Upgrade @jupyterlab/git to version 0.54.0 or higher.