CVE-2026-54528
CVE-2026-54528 · jupyterlab-git excluded_paths Case-Sensitivity Bypass Allows Reading Excluded Directories
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
JupyterLab Git is a Git extension for JupyterLab. Prior to 0.54.0, jupyterlab-git uses fnmatch.fnmatchcase() in GitHandler.prepare() in jupyterlab_git/handlers.py to enforce excluded_paths, allowing an authenticated user on a case-insensitive filesystem to vary URL path casing and read excluded directories. This issue is fixed in version 0.54.0.
CVSS 7.1 · Élevée · EPSS 0,4% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: python
Produits et versions concernés
jupyterlab-git
- Versions du logiciel
- < 0.54.0: Concernée
Aucun correctif publié
jupyterlab-git PyPI
- Versions du logiciel
- 0.1.1
- 0.1.2
- 0.10.0
- 0.10.1
- 0.10.1rc0
- 0.11.0
- 0.11.0rc0
- 0.11.0rc1
- 0.2.0
- 0.2.2
- 0.20.0
- 0.20.0rc0
- 0.21.0
- 0.21.0a0
- 0.21.0a1
- 0.21.0rc0
- 0.21.1
- 0.22.0
- 0.22.1
- 0.22.2
- 0.22.3
- 0.23.0
- 0.23.1
- 0.23.2
- 0.23.3
- 0.24.0
- 0.3.0
- 0.30.0
- 0.30.0b1
- 0.30.0b2
- 0.30.0b3
- 0.30.1
- 0.31.0
- 0.31.0a0
- 0.32.0
- 0.32.1
- 0.32.2
- 0.32.3
- 0.32.4
- 0.33.0
- 0.34.0
- 0.34.1
- 0.34.2
- 0.35.0
- 0.36.0
- 0.37.0
- 0.37.1
- 0.38.0
- 0.39.0
- 0.39.1
- 0.39.2
- 0.39.3
- 0.4.4
- 0.40.0
- 0.40.1
- 0.41.0
- 0.42.0
- 0.42.0rc0
- 0.43.0
- 0.44.0
- 0.5.0
- 0.50.0
- 0.50.0a0
- 0.50.0a1
- 0.50.0a2
- 0.50.0rc0
- 0.50.1
- 0.50.2
- 0.51.0
- 0.51.1
- 0.51.2
- 0.51.3
- 0.51.4
- 0.52.0
- 0.53.0
- 0.53.0a0
- 0.53.0a1
- 0.54.0a0
- 0.54.0a1
- 0.6.0
- 0.6.1
- 0.8.0
- 0.8.1
- 0.9.0
- 0.9.0rc1
- 0.9.1
- Plages de versions concernées
- ECOSYSTEM: < 0.54.0
Mettez à jour vers 0.54.0