CVE-2026-54528

Description

JupyterLab Git is a Git extension for JupyterLab. Prior to 0.54.0, jupyterlab-git uses fnmatch.fnmatchcase() in GitHandler.prepare() in jupyterlab_git/handlers.py to enforce excluded_paths, allowing an authenticated user on a case-insensitive filesystem to vary URL path casing and read excluded directories. This issue is fixed in version 0.54.0.

PUBLISHED Reserved 2026-06-15 | Published 2026-07-08 | Updated 2026-07-09 | Assigner GitHub_M

Problem types

CWE-178: Improper Handling of Case Sensitivity

Product status

References

github.com/...ab-git/security/advisories/GHSA-436q-jwfr-rm2h exploit

github.com/...ab-git/security/advisories/GHSA-436q-jwfr-rm2h

github.com/...ommit/460035275b5963dc96e364e60ba6a73717fbd033

github.com/jupyterlab/jupyterlab-git/releases/tag/v0.54.0

cve.org (CVE-2026-54528)

nvd.nist.gov (CVE-2026-54528)

Download JSON