Snowflake CLI Vulnerability Advisory
https://community.snowflake.com/s/article/Snowflake-CLI-Vulnerability-Advisory CVE-2026-13744
HIGH
Snowflake CLI SQL Injection Through Improper Neutralization of User-Controlled Input
Record summary
CVE-2026-13744 has a selected CVSS score of 8.3 (high).
Description
Improper neutralization of attacker-controlled content in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. By supplying crafted repository content, project configuration, manifest data, or specification input, an attacker could cause Snowflake CLI to execute unintended SQL in the context of the victim user's Snowflake session. Successful exploitation requires the victim to process attacker-controlled content through a vulnerable command path and is limited by the privileges assigned to that session. The fix is available in Snowflake CLI version 3.19. Users must manually upgrade.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 29, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
Snowflake CLIBrowse Snowflake / Snowflake CLIDefault status: unaffected | CVE List | 1.2.2 to < 3.19.0 | affected |
References
2nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-13744