JupyterLab Git is a Git extension for JupyterLab. Prior to 0.54.0, jupyterlab‑git uses fnmatch.fnmatchcase() in GitHandler.prepare() in jupyterlab_git/handlers.py to enforce excluded_paths, allowing an authenticated user on a case‑insensitive filesystem to vary URL path casing and read excluded directories. This issue is fixed in version 0.54.0.

The vulnerability affects installations of jupyterlab‑git before version 0.54.0. Any user with authenticated access to a JupyterLab instance running jupyterlab‑git 0.53.x or earlier is potentially impacted.

The CVSS score of 7.1 classifies this as high severity. The EPSS score of <1% indicates a very low probability of active exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation can be performed via the web interface by manipulating the capitalization of the URL path; exploitation requires only standard authentication to the JupyterLab instance and does not provide remote code execution or denial of service.