CVE-2026-13744: Snowflake CLI SQL Injection Through Improper Neutralization of User-Controlled Input
Improper neutralization of attacker-controlled content in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. By supplying crafted repository content, project configuration, manifest data, or specification input, an attacker could cause Snowflake CLI to execute unintended SQL in the context of the victim user's Snowflake session. Successful exploitation requires the victim to process attacker-controlled content through a vulnerable command path and is limited by the privileges assigned to that session. The fix is available in Snowflake CLI version 3.19. Users must manually upgrade.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Snowflake CLIto a version that resolves this vulnerability.Fixed in 3.19
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13744?
The severity of CVE-2026-13744 is rated as high with a score of 8.3.
How do I fix CVE-2026-13744?
To fix CVE-2026-13744, upgrade to Snowflake CLI version 3.19 or later.
What types of input can exploit CVE-2026-13744?
CVE-2026-13744 can be exploited through crafted repository content, project configuration, manifest data, or specification input.
What is the impact of CVE-2026-13744?
CVE-2026-13744 can lead to unintended SQL execution by allowing attacker-controlled content to be processed.
Which versions of Snowflake CLI are affected by CVE-2026-13744?
All versions of Snowflake CLI prior to 3.19 are affected by CVE-2026-13744.