Improper Handling of Case Sensitivity

Overview jupyterlab-git is an A JupyterLab extension for version control using git Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity in the prepare function due to improper enforcement of excluded directory paths on case-insensitive filesystems. An attacker...

GHSA-436Q-JWFR-RM2H jupyterlab-git excluded_paths Case-Sensitivity Bypass Allows Reading Excluded Directories

Summary jupyterlab-git 0.53.0 latest, 2026-04-30 uses fnmatch.fnmatchcase in GitHandler.prepare jupyterlabgit/handlers.py:91 to enforce the admin-configured excludedpaths security control. Because fnmatchcase is unconditionally case-sensitive, an authenticated user on a case-insensitive filesyste...

@jupyterlab/pullrequests (>=2.0.0-alpha.0, <=3.0.2) potentially affected by CVE-2026-54527 via @jupyterlab/git (>=0.30.0, <=0.40.0)

@jupyterlab/git NPM version =0.30.0, =2.0.0-alpha.0, =3.0.2 Source cves: CVE-2026-54527 Source advisory: GHSA-F962-V9HR-PFG5...

@jupyterlab/pullrequests (>=2.0.0-alpha.0, <=3.0.2) potentially affected by CVE-2026-54527 via @jupyterlab/git (>=0.30.0, <=0.40.0)

@jupyterlab/git NPM version =0.30.0, =2.0.0-alpha.0, =3.0.2 Source cves: CVE-2026-54527 Source advisory: OSV:GHSA-F962-V9HR-PFG5...

jupyterlab-git extension: Stored XSS leading to RCE

Overview Amazon Web Services AWS Security has identified a stored cross-site scripting XSS issue in the jupyterlab-git JupyterLab extension that can lead to remote code execution RCE. The issue exists in the PlainTextDiff.ts component, where the createHeader method passes Git filenames directly t...

elyra (>=2.2.2, <=4.1.1), elyra-code-snippet-extension (>=1.3.0, <=4.1.1) +12 more potentially affected by CVE-2026-54527 via jupyterlab-git (>=0.30.0, <=0.52.0)

jupyterlab-git PYPI version =0.30.0, =2.2.2, =1.3.0, =3.14.0, =1.3.0, =1.3.0, =2.2.2, =3.14.0, =2.2.2, =0.4.0, =3.0.0b0, =0.1.30, =1.3.19, =0.1.0, =0.2.9 Source cves: CVE-2026-54527 Source advisory: GHSA-F962-V9HR-PFG5...

GHSA-F962-V9HR-PFG5 jupyterlab-git extension: Stored XSS leading to RCE

Overview Amazon Web Services AWS Security has identified a stored cross-site scripting XSS issue in the jupyterlab-git JupyterLab extension that can lead to remote code execution RCE. The issue exists in the PlainTextDiff.ts component, where the createHeader method passes Git filenames directly t...

Cross-site Scripting (XSS)

Overview @jupyterlab/git is an A JupyterLab extension for version control using git Affected versions of this package are vulnerable to Cross-site Scripting XSS in the createHeader method. An attacker can execute arbitrary JavaScript in another user's browser session by crafting a malicious...

fps-jupyterlab-git (>=0.3.0, <=0.3.1) potentially affected by CVE-2026-54527 via jupyterlab-git-core (0.53.0)

jupyterlab-git-core PYPI version 0.53.0 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab-git-core and may be impacted: - fps-jupyterlab-git =0.3.0, =0.3.1 Source cves: CVE-2026-54527 Source advisory: OSV:GHSA-F962-V9HR-PFG5...

elyra (>=2.2.2, <=4.1.1), elyra-code-snippet-extension (>=1.3.0, <=4.1.1) +12 more potentially affected by CVE-2026-54527 via jupyterlab-git (>=0.30.0, <=0.52.0)

jupyterlab-git PYPI version =0.30.0, =2.2.2, =1.3.0, =3.14.0, =1.3.0, =1.3.0, =2.2.2, =3.14.0, =2.2.2, =0.4.0, =3.0.0b0, =0.1.30, =1.3.19, =0.1.0, =0.2.9 Source cves: CVE-2026-54527 Source advisory: OSV:GHSA-F962-V9HR-PFG5...

@jupyterlab/pullrequests (>=2.0.0-alpha.0, <=3.0.2) potentially affected by CVE-2026-54527 via @jupyterlab/git (>=0.30.0, <=0.40.0)

@jupyterlab/git NPM version =0.30.0, =2.0.0-alpha.0, =3.0.2 Source cves: CVE-2026-54527 Source advisory: SNYK:JS-JUPYTERLABGIT-17391473...

fps-jupyterlab-git (>=0.3.0, <=0.3.1) potentially affected by CVE-2026-54527 via jupyterlab-git-core (0.53.0)

jupyterlab-git-core PYPI version 0.53.0 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab-git-core and may be impacted: - fps-jupyterlab-git =0.3.0, =0.3.1 Source cves: CVE-2026-54527 Source advisory: GHSA-F962-V9HR-PFG5...

PT-2026-51066

Name of the Vulnerable Software and Affected Versions jupyterlab-git versions prior to 0.54.0 Description An authenticated user on a case-insensitive filesystem such as macOS APFS or Windows NTFS can bypass the excluded paths security control. The issue occurs because the GitHandler.prepare...

PT-2026-51065

Name of the Vulnerable Software and Affected Versions jupyterlab-git affected versions not specified Description A stored cross-site scripting XSS issue exists in the PlainTextDiff.ts component of the jupyterlab-git extension. The createHeader function passes Git filenames directly to innerHTML...

CVE-2026-54528

creationtimestamp| type| source ---|---|--- 2026-06-18 07:12:50+00:00| published-proof-of-concept| https://github.com/jupyterlab/jupyterlab-git/security/advisories/GHSA-436q-jwfr-rm2h 2026-08-01 18:19:51+00:00| seen| https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3ms23gwvzea2r...

Open Git Repository in Terminal JupyterLab Command Execution

The vulnerability of the “Open Git Repository in Terminal” control element in the JupyterLab-Git web-oriented interactive development environment is related to the failure to implement measures to neutralize special elements used in the operating system command line. Exploiting this vulnerability...

elyra (>=0.7.1, <=4.0.0rc4), elyra-code-snippet-extension (>=1.3.1, <=4.0.0rc2) +11 more potentially affected by CVE-2025-30370 via jupyterlab-git (>=0.11.0, <=0.50.2)

jupyterlab-git PYPI version =0.11.0, =0.7.1, =1.3.1, =3.14.0, =1.3.1, =1.3.1, =2.2.0, =3.14.0, =1.3.1, =0.4.0, =2.1.0, =0.1.30, =1.3.19, =0.1.0, =0.2.9 Source cves: CVE-2025-30370 Source advisory: GHSA-CJ5W-8MJF-R5F8...

GHSA-CJ5W-8MJF-R5F8 jupyterlab-git has a command injection vulnerability in "Open Git Repository in Terminal"

Overview On many platforms, a third party can create a Git repository under a name that includes a shell command substitution ^1 string in the syntax $. These directory names are allowed in macOS and a majority of Linux distributions ^2. If a user starts jupyter-lab in a parent directory of this...

jupyterlab-git has a command injection vulnerability in "Open Git Repository in Terminal"

Overview On many platforms, a third party can create a Git repository under a name that includes a shell command substitution ^1 string in the syntax $. These directory names are allowed in macOS and a majority of Linux distributions ^2. If a user starts jupyter-lab in a parent directory of this...

elyra (>=0.7.1, <=4.0.0rc4), elyra-code-snippet-extension (>=1.3.1, <=4.0.0rc2) +11 more potentially affected by CVE-2025-30370 via jupyterlab-git (>=0.11.0, <=0.50.2)

jupyterlab-git PYPI version =0.11.0, =0.7.1, =1.3.1, =3.14.0, =1.3.1, =1.3.1, =2.2.0, =3.14.0, =1.3.1, =0.4.0, =2.1.0, =0.1.30, =1.3.19, =0.1.0, =0.2.9 Source cves: CVE-2025-30370 Source advisory: OSV:GHSA-CJ5W-8MJF-R5F8...