Vulnerability Description
JupyterLab Git is a Git extension for JupyterLab. Prior to 0.54.0, jupyterlab-git uses fnmatch.fnmatchcase() in GitHandler.prepare() in jupyterlab_git/handlers.py to enforce excluded_paths, allowing an authenticated user on a case-insensitive filesystem to vary URL path casing and read excluded directories. This issue is fixed in version 0.54.0.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Jupyter | Jupyterlab-Git | < 0.54.0 |
Related Weaknesses (CWE)
References
- https://github.com/jupyterlab/jupyterlab-git/commit/460035275b5963dc96e364e60ba6Patch
- https://github.com/jupyterlab/jupyterlab-git/releases/tag/v0.54.0Release Notes
- https://github.com/jupyterlab/jupyterlab-git/security/advisories/GHSA-436q-jwfr-ExploitVendor Advisory
- https://github.com/jupyterlab/jupyterlab-git/security/advisories/GHSA-436q-jwfr-ExploitVendor Advisory
FAQ
What is CVE-2026-54528?
CVE-2026-54528 is a vulnerability with a CVSS score of 7.1 (HIGH). JupyterLab Git is a Git extension for JupyterLab. Prior to 0.54.0, jupyterlab-git uses fnmatch.fnmatchcase() in GitHandler.prepare() in jupyterlab_git/handlers.py to enforce excluded_paths, allowing a...
How severe is CVE-2026-54528?
CVE-2026-54528 has been rated HIGH with a CVSS base score of 7.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-54528?
Check the references section above for vendor advisories and patch information. Affected products include: Jupyter Jupyterlab-Git.