CVE-2026-54528

HighCVSS 7.1

Published: 08/07/2026(UTC)Updated: 15/07/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

22th percentile - higher than 22% of all known CVEs

Summary

JupyterLab Git prior to version 0.54.0 uses fnmatch.fnmatchcase() in GitHandler.prepare() to enforce excluded_paths. An authenticated user on a case-insensitive filesystem can vary URL path casing and read excluded directories.

Risk Assessment

The organization is at risk of unauthorized access to sensitive data stored in excluded Git repository directories, potentially leading to information disclosure.

Recommendation

Immediately upgrade JupyterLab Git to version 0.54.0 or later, which includes a fix for this vulnerability.

Other vulnerabilities in JupyterLab Git

CVE-2026-54527Critical
The JupyterLab Git extension before version 0.54.0 contains an XSS vulnerability in the createHeader() method of PlainTextDiff.ts. When rendering renamed files in commit history, filenames are passed directly to innerHTML, allowing a crafted filename to execute JavaScript when a victim views the rename diff in the Git History tab.

Original NVD description (English source)

JupyterLab Git is a Git extension for JupyterLab. Prior to 0.54.0, jupyterlab-git uses fnmatch.fnmatchcase() in GitHandler.prepare() in jupyterlab_git/handlers.py to enforce excluded_paths, allowing an authenticated user on a case-insensitive filesystem to vary URL path casing and read excluded directories. This issue is fixed in version 0.54.0.