elyra (>=0.7.1, <=4.1.1), elyra-code-snippet-extension (>=1.3.0, <=4.1.1) +12 more potentially affected by CVE-2026-54528 via jupyterlab-git (>=0.11.0, <=0.52.0)

jupyterlab-git PYPI version =0.11.0, =0.7.1, =1.3.0, =3.14.0, =1.3.0, =1.3.0, =2.2.0, =3.14.0, =1.3.1, =0.4.0, =2.1.0, =0.1.30, =1.3.19, =0.1.0, =0.2.9 Source cves: CVE-2026-54528 Source advisory: MEND:CVE-2026-54528...

CVE-2026-54528

JupyterLab Git is a Git extension for JupyterLab. Prior to 0.54.0, jupyterlab-git uses fnmatch.fnmatchcase in GitHandler.prepare in jupyterlabgit/handlers.py to enforce excludedpaths, allowing an authenticated user on a case-insensitive filesystem to vary URL path casing and read excluded...

CVE-2026-54528

Summary of vulnerability (CVE-2026-54528): The jupyterlab-git extension for JupyterLab is affected prior to version 0.54.0. On case-insensitive filesystems (e.g., macOS APFS, Windows NTFS), the code path that enforces excluded_paths uses fnmatch.fnmatchcase(), which is case-sensitive and can be b...

CVE-2026-54528 jupyterlab-git excluded_paths Case-Sensitivity Bypass Allows Reading Excluded Directories

JupyterLab Git is a Git extension for JupyterLab. Prior to 0.54.0, jupyterlab-git uses fnmatch.fnmatchcase in GitHandler.prepare in jupyterlabgit/handlers.py to enforce excludedpaths, allowing an authenticated user on a case-insensitive filesystem to vary URL path casing and read excluded...

elyra (>=0.7.1, <=4.1.1), elyra-code-snippet-extension (>=1.3.0, <=4.1.1) +12 more potentially affected by CVE-2026-54528 via jupyterlab-git (>=0.11.0, <=0.52.0)

jupyterlab-git PYPI version =0.11.0, =0.7.1, =1.3.0, =3.14.0, =1.3.0, =1.3.0, =2.2.0, =3.14.0, =1.3.1, =0.4.0, =2.1.0, =0.1.30, =1.3.19, =0.1.0, =0.2.9 Source cves: CVE-2026-54528 Source advisory: GHSA-436Q-JWFR-RM2H...

elyra (>=0.7.1, <=4.1.1), elyra-code-snippet-extension (>=1.3.0, <=4.1.1) +12 more potentially affected by CVE-2026-54528 via jupyterlab-git (>=0.11.0, <=0.52.0)

jupyterlab-git PYPI version =0.11.0, =0.7.1, =1.3.0, =3.14.0, =1.3.0, =1.3.0, =2.2.0, =3.14.0, =1.3.1, =0.4.0, =2.1.0, =0.1.30, =1.3.19, =0.1.0, =0.2.9 Source cves: CVE-2026-54528 Source advisory: SNYK:PYTHON-JUPYTERLABGIT-17391476...