CVE-2026-54528 HIGH

CVE-2026-54528: jupyterlab-git excluded_paths Case-Sensitivity Bypass Allows Reading Excluded Directories

Vendor Jupyterlab
Product jupyterlab-git
Weakness CWE-178
Published July 8, 2026
Last update July 9, 2026
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

What the vulnerability does

01Description

JupyterLab Git is a Git extension for JupyterLab. Prior to 0.54.0, jupyterlab-git uses fnmatch.fnmatchcase() in GitHandler.prepare() in jupyterlab_git/handlers.py to enforce excluded_paths, allowing an authenticated user on a case-insensitive filesystem to vary URL path casing and read excluded directories. This issue is fixed in version 0.54.0.

Key dates

02Disclosure timeline

July 8, 2026 CVE published
July 9, 2026 Record updated