Vulnerability · Published Jun 29, 2026 · Assigned by SNOWFLAKE

CVE-2026-13744Snowflake CLI SQL Injection Through Improper Neutralization of User-Controlled Input

High 8.3

In plain English

A high-severity SQL injection in Snowflake CLI from Snowflake. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 3.1)8.3High

Exploit odds (30 days)0.5%top 59.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Improper neutralization of attacker-controlled content in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. By supplying crafted repository content, project configuration, manifest data, or specification input, an attacker could cause Snowflake CLI to execute unintended SQL in the context of the victim user's Snowflake session. Successful exploitation requires the victim to process attacker-controlled content through a vulnerable command path and is limited by the privileges assigned to that session. The fix is available in Snowflake CLI version 3.19. Users must manually upgrade.

Affected products (as reported)

Vendor	Product	Versions
Snowflake	Snowflake CLI	1.2.2 – before 3.19.0

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

References

Snowflake CLI Vulnerability Advisory