SQL Execution Vulnerability in Snowflake CLI by Snowflake

CVE-2026-13752

What is CVE-2026-13752?

A vulnerability in the Snowflake CLI prior to version 3.19 allows for unintended SQL execution due to improper neutralization of command parameters. Attackers can exploit this vulnerability by supplying crafted values, which may reach vulnerable parameters through means such as socially engineered input or faulty automation configurations. This could lead to arbitrary SQL commands being executed within the context of the affected user's Snowflake session. The degree of impact is contingent upon the privileges assigned to the user session. To mitigate this risk, users are urged to upgrade to Snowflake CLI version 3.19, where a fix has been implemented.

References