GitPython's Repo.clone_from() and Repo.clone() methods forward keyword arguments to the underlying git clone command, filtering unsafe options via a denylist (Repo.unsafe_git_clone_options). However, this denylist omits the --separate-git-dir option, which redirects the repository's .git metadata directory to an arbitrary path. Although the documentation states that allow_unsafe_options=False (default) should block this option, it is not included in the denylist, allowing an attacker who controls input to pass separate_git_dir to clone_from()/clone() and cause git to create repository metadata outside the intended destination. This can lead to arbitrary directory and file creation at attacker-controlled locations, bounded only by filesystem permissions. The root cause is a parity gap between denylist entries for clone and init commands, with the latter correctly blocking --separate-git-dir. This vulnerability is similar in nature to previously published GitPython issues where denylist omissions allowed unsafe options. The affected versions are snowflake-cli versions >=3.4.1 and <3.27.0. The CVSS 3.1 score is 7.5 (High).

An attacker able to supply a separate_git_dir argument to GitPython's clone_from() or clone() methods can cause arbitrary creation of git repository metadata directories and files at any filesystem path writable by the process. This enables placing git hooks or other repository files outside the intended clone destination, potentially leading to unauthorized code execution or persistence mechanisms depending on the environment. The impact is limited by the permissions of the process running GitPython but can be significant in multi-tenant or CI/build environments.

A patch is available for this vulnerability. Users should upgrade to a fixed version of snowflake-cli that includes the corrected denylist for unsafe git clone options. Until patched, avoid passing the separate_git_dir or separate-git-dir option to Repo.clone_from() or Repo.clone(), and do not set allow_unsafe_options=True unless absolutely necessary and safe. Review any applications or services that expose git clone options to clients to ensure they do not allow this parameter. Follow vendor advisories for official patch releases and remediation guidance.