JupyterLab Git is a Git extension for JupyterLab. Prior to version 0.54.0, it uses fnmatch.fnmatchcase() in the GitHandler.prepare() function to enforce excluded_paths. On a case‑insensitive filesystem, an authenticated user can vary the capitalization of a URL path and read files in directories that should be hidden. This case‑sensitivity error (CWE‑178) allows disclosure of repository content that was intended to be excluded, leading to unauthorized data exposure.

The vulnerability affects installations of jupyterlab‑git before version 0.54.0. Any user with authenticated access to a JupyterLab instance running jupyterlab‑git 0.53.x or earlier is potentially impacted.

The CVSS score of 7.1 classifies this as high severity. The EPSS score of <1% indicates a very low probability of active exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation can be performed via the web interface by manipulating the capitalization of the URL path; exploitation requires only standard authentication to the JupyterLab instance and does not provide remote code execution or denial of service.