p PatchFirst

CVE-2026-54528

CVE-2026-54528 · jupyterlab-git excluded_paths Case-Sensitivity Bypass Allows Reading Excluded Directories

This page contains facts from public vulnerability sources. Check the original advisory before updating.

JupyterLab Git is a Git extension for JupyterLab. Prior to 0.54.0, jupyterlab-git uses fnmatch.fnmatchcase() in GitHandler.prepare() in jupyterlab_git/handlers.py to enforce excluded_paths, allowing an authenticated user on a case-insensitive filesystem to vary URL path casing and read excluded directories. This issue is fixed in version 0.54.0.

CVSS 7.1 · High · EPSS 0.4% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • jupyterlab-git

    Versions
    • < 0.54.0: Affected

    No fix published

  • jupyterlab-git PyPI

    Versions
    • 0.1.1
    • 0.1.2
    • 0.10.0
    • 0.10.1
    • 0.10.1rc0
    • 0.11.0
    • 0.11.0rc0
    • 0.11.0rc1
    • 0.2.0
    • 0.2.2
    • 0.20.0
    • 0.20.0rc0
    • 0.21.0
    • 0.21.0a0
    • 0.21.0a1
    • 0.21.0rc0
    • 0.21.1
    • 0.22.0
    • 0.22.1
    • 0.22.2
    • 0.22.3
    • 0.23.0
    • 0.23.1
    • 0.23.2
    • 0.23.3
    • 0.24.0
    • 0.3.0
    • 0.30.0
    • 0.30.0b1
    • 0.30.0b2
    • 0.30.0b3
    • 0.30.1
    • 0.31.0
    • 0.31.0a0
    • 0.32.0
    • 0.32.1
    • 0.32.2
    • 0.32.3
    • 0.32.4
    • 0.33.0
    • 0.34.0
    • 0.34.1
    • 0.34.2
    • 0.35.0
    • 0.36.0
    • 0.37.0
    • 0.37.1
    • 0.38.0
    • 0.39.0
    • 0.39.1
    • 0.39.2
    • 0.39.3
    • 0.4.4
    • 0.40.0
    • 0.40.1
    • 0.41.0
    • 0.42.0
    • 0.42.0rc0
    • 0.43.0
    • 0.44.0
    • 0.5.0
    • 0.50.0
    • 0.50.0a0
    • 0.50.0a1
    • 0.50.0a2
    • 0.50.0rc0
    • 0.50.1
    • 0.50.2
    • 0.51.0
    • 0.51.1
    • 0.51.2
    • 0.51.3
    • 0.51.4
    • 0.52.0
    • 0.53.0
    • 0.53.0a0
    • 0.53.0a1
    • 0.54.0a0
    • 0.54.0a1
    • 0.6.0
    • 0.6.1
    • 0.8.0
    • 0.8.1
    • 0.9.0
    • 0.9.0rc1
    • 0.9.1
    Affected ranges
    • ECOSYSTEM: < 0.54.0

    Update to 0.54.0

Original sources

Check your server →