SQL Injection in Snowflake Cli
CVE-2026-13744
Improper neutralization of attacker-controlled content in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. By supplying crafted repository content, project configuration, manifest data, or specification input, an attacker could cause Snowflake CLI to execute unintended SQL in the context of the victim user's Snowflake session. Successful exploitation requires the victim to process attacker-controlled content through a vulnerable command path and is limited by the privileges assigned to that session. The fix is available in Snowflake CLI version 3.19. Users must manually upgrade.
Vulnerability class: SQL Injection
EPSS: 0.003 (24.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.3 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H.
Affected products
- Snowflake Cli — versions 1.2.2
- Snowflake Snowflake_cli
Weakness classification (CWE)
References
- 412d305a-227d-44f9-a262-a31ba44f2aea (Vendor Advisory)
Frequently asked questions
- What is CVE-2026-13744?
- CVE-2026-13744 is a high-severity vulnerability in Snowflake Cli, classified under SQL Injection. CVSS score: 8.3/10. Published 2026-06-29.
- How severe is CVE-2026-13744?
- High severity. CVSS v3 base score is 8.3 out of 10.