CVE-2025-30370

A flaw was found in jupyterlab-git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $. These directory names are allowed in macOS and a majority of Linux distributions. If a user starts jupyter-lab in a pare...

elyra (>=0.7.1, <=4.0.0rc4), elyra-code-snippet-extension (>=1.3.1, <=4.0.0rc2) +11 more potentially affected by CVE-2025-30370 via jupyterlab-git (>=0.11.0, <=0.50.2)

jupyterlab-git PYPI version =0.11.0, =0.7.1, =1.3.1, =3.14.0, =1.3.1, =1.3.1, =2.2.0, =3.14.0, =1.3.1, =0.4.0, =2.1.0, =0.1.30, =1.3.19, =0.1.0, =0.2.9 Source cves: CVE-2025-30370 Source advisory: MEND:CVE-2025-30370...

elyra (>=0.7.1, <=4.0.0rc4), elyra-code-snippet-extension (>=1.3.1, <=4.0.0rc2) +11 more potentially affected by CVE-2025-30370 via jupyterlab-git (>=0.11.0, <=0.50.2)

jupyterlab-git PYPI version =0.11.0, =0.7.1, =1.3.1, =3.14.0, =1.3.1, =1.3.1, =2.2.0, =3.14.0, =1.3.1, =0.4.0, =2.1.0, =0.1.30, =1.3.19, =0.1.0, =0.2.9 Source cves: CVE-2025-30370 Source advisory: SNYK:PYTHON-JUPYTERLABGIT-9667341...

CVE-2025-30370 jupyterlab-git has a command injection vulnerability in "Open Git Repository in Terminal"

jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $. These directory names are allowed in macOS and a majority of Linux distributions. If...

Command Injection

Overview jupyterlab-git is an A JupyterLab extension for version control using git Affected versions of this package are vulnerable to Command Injection in the addCommands function, which executes a cd command on the input passed in to the "Open Git Repository in Terminal" interface. If a user wi...

CVE-2025-30370

jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $. These directory names are allowed in macOS and a majority of Linux distributions. If...

CVE-2025-30370

CVE-2025-30370 affects the jupyterlab-git JupyterLab extension. When a user opens a repository whose directory name contains a shell command substitution (e.g., $()) and selects “Git &gt; Open Git Repository in Terminal,” the extension previously executed a shell command via a cd to the repositor...

CVE-2025-30370: Improper Neutralization of Special Elements used in an OS Command

jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $ . These directory names are allowed in macOS and a majority of Linux distributions. I...

PT-2025-14811

Name of the Vulnerable Software and Affected Versions jupyterlab-git versions prior to 0.51.1 Description The issue arises when a user opens a maliciously named Git repository in jupyterlab-git and clicks "Git Open Git Repository in Terminal" from the menu bar. This action can lead to the executi...

jupyterlab-git security vulnerabilities

jupyterlab-git is an open source Git extension for JupyterLab. A security vulnerability exists in jupyterlab-git that stems from a command injection that can be caused when a command substitution string is included in a directory name...

elyra (>=2.0.0, <=2.2.1), elyra-code-snippet-extension (>=2.2.0, <=2.2.1) +5 more potentially affected by CVE-2021-41134 via nbdime (3.0.0)

nbdime PYPI version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on nbdime and may be impacted: - elyra =2.0.0, =2.2.0, =2.2.0, =2.2.0, =2.2.0, =2.0.0, =0.30.0b1, =0.30.0b3 Source cves: CVE-2021-41134 Source advisory: GHSA-P6RW-44Q7-3FW4...

@jupyterlab/git (>=0.1.0, <=0.6.0), nbdime-jupyterlab (>=0.1.0, <=0.6.1) potentially affected by CVE-2021-41134 via nbdime (>=1.0.4, <=4.0.2)

nbdime NPM version =1.0.4, =0.1.0, =0.1.0, =0.6.1 Source cves: CVE-2021-41134 Source advisory: MEND:CVE-2021-41134...