Improper Neutralization Vulnerability in Snowflake CLI Affects Snowflake Products

CVE-2026-13744

What is CVE-2026-13744?

The Snowflake CLI has a vulnerability that allows attackers to execute unintended SQL commands by manipulating user-provided inputs. Specifically, in versions prior to 3.19, crafted repositories, project configurations, manifest data, or specification inputs can lead to execution in the context of the victim user's Snowflake session. This exploitation occurs if the victim processes these maliciously crafted inputs through a vulnerable command path, and is restricted to the privileges of the session. Users are advised to manually upgrade to Snowflake CLI version 3.19 or later to mitigate this risk.

References