CVE-2026-54528
High
Description
JupyterLab Git is a Git extension for JupyterLab. Prior to 0.54.0, jupyterlab-git uses fnmatch.fnmatchcase() in GitHandler.prepare() in jupyterlab_git/handlers.py to enforce excluded_paths, allowing an authenticated user on a case-insensitive filesystem to vary URL path casing and read excluded directories. This issue is fixed in version 0.54.0.
SeverityHigh
CVSS7.1
Exploit probability—
ProductJupyterlab-git
PublishedJul 8, 2026
First seenJul 8, 2026
Weakness typeCWE-178CWE-178
How to fix
Update
- jupyter jupyterlab-git0.54.0 or later
- jupyterlab-git0.54.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jupyter jupyterlab-git | v < 0.54.0 | 0.54.0 |
| jupyterlab-gitPyPI | v < 0.54.0 | 0.54.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.