Improper Code Neutralization in Snowflake CLI Products

CVE-2026-13749

What is CVE-2026-13749?

The vulnerability in the Snowflake CLI arises from improper neutralization in the annotation processor callback template, which permits arbitrary code execution during the application's bundling or deployment phases. Attackers can exploit this weakness by providing specially crafted project content that is injected into generated Python scripts. If a user executes the deployment workflow involving the manipulated project content, the Snowflake CLI could inadvertently execute the attacker's code with the user's permissions. To mitigate this risk, users are encouraged to upgrade to Snowflake CLI version 3.19, where the vulnerability has been addressed.

References