CVE-2026-54528
jupyterlab-git excluded_paths Case-Sensitivity Bypass Allows Reading Excluded Directories
HIGH 7.1EPSS 0.4%
JupyterLab Git is a Git extension for JupyterLab. Prior to 0.54.0, jupyterlab-git uses fnmatch.fnmatchcase() in GitHandler.prepare() in jupyterlab_git/handlers.py to enforce excluded_paths, allowing an authenticated user on a case-insensitive filesystem to vary URL path casing and read excluded directories. This issue is fixed in version 0.54.0.
- Affected
- jupyterlab · jupyterlab-git
- CVSS v3.1 GITHUB
- 7.1 HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N - EPSS
- 0.41% chance of exploitation in the next 30 days, 34th percentile
- Published
- 2026-07-08
- Updated
- 2026-07-09
Proof-of-concept exploits (1)
Security advisories
- jupyterlab/jupyterlab-git/security/advisories/GHSA-436q-jwfr-rm2h
- jupyterlab/jupyterlab-git/commit/460035275b5963dc96e364e60ba6a73717fbd033