Vulnerabilities

TI-2026-11593 CVE-2026-13752 · GHSA-2jqx-3g86-5c63

SQL injection in Snowflake CLI

LOW 37

Improper neutralization of parameters in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution.

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.00327 Published 2026-06-29 Fixed in 3.19.0 CWE-89

TI-2026-11592 CVE-2026-13751 · GHSA-6xpv-fwh6-29jc

Snowflake CLI Server-Side Request Forgery via Arbitrary URL Fetch in !source/!load

MEDIUM 41

Improper handling of untrusted remote references in Snowflake CLI versions prior to 3.19 allowed server-side request forgery.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.00204 Published 2026-06-29 Fixed in 3.19.0 CWE-829

TI-2026-11591 CVE-2026-13750 · GHSA-hrp8-4956-5gr5

Snowflake CLI Sensitive Credential Exposure Through Debug Logging

LOW 24

Insertion of sensitive information into log files in Snowflake CLI versions prior to 3.19 allowed plaintext credentials to be written to persistent local debug logs.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00151 Published 2026-06-29 Fixed in 3.19.0 CWE-532

TI-2026-11590 CVE-2026-13749 · GHSA-gxp8-hq7m-332h

Snowflake CLI Arbitrary Code Execution via Snowpark Annotation Processor Template Injection

MEDIUM 41

Improper neutralization in the Snowpark annotation processor callback template in Snowflake CLI versions prior to 3.19 allowed arbitrary code execution during application bundling or deployment.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00538 Published 2026-06-29 Fixed in 3.19.0 CWE-94

TI-2026-11589 CVE-2026-13748 · GHSA-8394-2w3w-5r9h

Snowflake CLI Arbitrary Local File Read and Exfiltration Through Improper File Path Restriction

LOW 27

Improper restriction of file path resolution in Snowflake CLI versions prior to 3.19 allowed arbitrary local file content to be read and transmitted to Snowflake services.

CVSS 3.1MEDIUM 6.3 Local No auth User interaction EPSS 0.00185 Published 2026-06-29 Fixed in 3.19.0 CWE-22

TI-2026-11588 CVE-2026-13746 · GHSA-656q-44hg-7hm7

Snowflake CLI SQL Injection Through Improper Neutralization of Local CLI Parameters

LOW 24

Improper neutralization of local CLI parameters in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00218 Published 2026-06-29 Fixed in 3.19.0 CWE-89

TI-2026-11586 CVE-2026-13744 · GHSA-6whc-m7mm-g2x4

Snowflake CLI SQL Injection Through Improper Neutralization of User-Controlled Input

MEDIUM 40

Improper neutralization of attacker-controlled content in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00465 Published 2026-06-29 Fixed in 3.19.0 CWE-89