The vulnerability stems from SubmoduleConfigParser in GitPython defaulting merge_includes to true when parsing the .gitmodules file, which is fully attacker-controlled in cloned repositories. This allows an attacker to specify an [include] directive pointing to arbitrary local files (e.g., /etc/passwd). When the parser attempts to read these files, it raises a MissingSectionHeaderError if the file is not a valid git config, embedding the first line of the file in the exception message. This exception propagates to any application code accessing repo.submodules, leaking sensitive local file content. The root cause is a parity gap where the config writer disables merge_includes but the submodule config parser does not. The vulnerability affects Snowflake CLI versions >=3.4.1 and <3.27.0, with a CVSS 3.1 score of 8.4 (high severity). A patch is available.

This vulnerability allows local file content disclosure of the first line of any readable file on the victim's system through exception messages triggered by parsing a malicious .gitmodules file. This can expose sensitive information such as system files or credentials. The attack requires no privileges and no user interaction beyond accessing repo.submodules in the affected software. The impact is confidentiality loss of local file data, rated high severity with CVSS 8.4.

A patch is available for this vulnerability. Users should upgrade Snowflake CLI to a fixed version outside the affected range (>=3.4.1 <3.27.0). The vendor advisory confirms a fix exists. Until patched, avoid processing untrusted repositories with affected versions or modify the code to disable merge_includes when parsing .gitmodules. No other mitigation is indicated by the vendor advisory.