Executive brief
Snowflake CLI is a command-line tool used by developers and data engineers to manage Snowflake data platforms. A vulnerability in versions prior to 3.19 could allow an attacker to execute unauthorized database commands if a user interacts with malicious project files or repository content. This could lead to unauthorized data access or modification within the scope of the user's active session permissions.
Technical details
A SQL injection vulnerability (CWE-89) exists in Snowflake CLI due to improper neutralization of attacker-controlled content. The flaw is triggered when the CLI processes crafted repository content, project configurations, manifest data, or specification inputs. An attacker can leverage this to execute arbitrary SQL commands within the victim's Snowflake session. Exploitation requires user interaction (UI:R), specifically the victim processing the malicious content through a vulnerable command path. The impact is limited by the privileges of the active session, but the vulnerability carries a high CVSS score due to potential scope crossing (S:C). The issue is resolved in Snowflake CLI version 3.19.
Affected products
- Snowflake Snowflake CLI 1.2.2 to 3.18.x (fixed in 3.19.0)
Timeline
- 2026-06-29: advisory
- 2026-06-29: disclosed