Executive brief
The Snowflake Command Line Interface (CLI) is a tool used by developers and administrators to manage Snowflake data and services. A vulnerability in versions prior to 3.19 allowed for unintended SQL command execution when specific local parameters were improperly handled. Because this requires the attacker to already have local access to the system and the ability to run CLI commands, the impact is limited to the permissions of the current user session.
Technical details
A SQL injection vulnerability (CWE-89) exists in the Snowflake CLI due to improper neutralization of local CLI parameters. An attacker with local access can supply crafted values to vulnerable Cortex SQL or object listing command paths, leading to the execution of unintended SQL commands within the context of the user's active Snowflake session. The vulnerability is classified as a 'self-injection' because the malicious parameters must be supplied directly via local CLI arguments rather than external sources like project files. The impact is restricted to the privileges of the authenticated session. The issue is resolved in Snowflake CLI version 3.19.0.
Affected products
- Snowflake Snowflake CLI >=2.0.0, <3.19.0
Timeline
- 2026-06-29: advisory: Initial disclosure by Snowflake and NVD publication
- 2026-06-29: patched: Fix released in Snowflake CLI version 3.19.0