CVE-2026-13744

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-13744

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-13744.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-13744

Published

2026-06-29T15:40:47.721Z

Modified

2026-08-12T03:51:26.480110808Z

Severity

8.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H CVSS Calculator

Summary

Snowflake CLI SQL Injection Through Improper Neutralization of User-Controlled Input

Details

Improper neutralization of attacker-controlled content in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. By supplying crafted repository content, project configuration, manifest data, or specification input, an attacker could cause Snowflake CLI to execute unintended SQL in the context of the victim user's Snowflake session. Successful exploitation requires the victim to process attacker-controlled content through a vulnerable command path and is limited by the privileges assigned to that session. The fix is available in Snowflake CLI version 3.19. Users must manually upgrade.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/13xxx/CVE-2026-13744.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "1.2.2"
                },
                {
                    "fixed": "3.19.0"
                }
            ]
        }
    ],
    "cwe_ids": [
        "CWE-89"
    ],
    "cna_assigner": "SNOWFLAKE"
}

References

Affected packages

Git / github.com/snowflakedb/snowflake-cli

Affected ranges

Type

GIT

Repo

https://github.com/snowflakedb/snowflake-cli

Events

Introduced

9fca86f9c64452c71f06bfdac39a2f70234c4cf7

Fixed

fc3762316a81defb89869ecfedbcde179f326d48

Database specific

Show details

{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:snowflake:snowflake_cli:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.2.2"
        },
        {
            "fixed": "3.19.0"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-13744.json"