ConsoleMe versions prior to 1.4.0 have an arbitrary file read vulnerability via a limited Git command flag injection. Authenticated users can read any files accessible by the ConsoleMe process, potentially exposing secrets used for AWS identity brokering. This vulnerability arises from improper sanitization of user-supplied filenames in templated resource requests, allowing flag injection in CLI commands. Deployments without templated resources configured are not affected. The issue is patched in ConsoleMe version 1.4.0.