Executive brief
A vulnerability in the Snowflake Command Line Interface (CLI) could allow an attacker to execute unauthorized database commands. This occurs when the tool processes specially crafted input from malicious configuration files or automated systems. If exploited, an attacker could perform actions within the database using the same permissions as the logged-in user, potentially leading to unauthorized data access or modification.
Technical details
A SQL injection vulnerability (CWE-89) exists in Snowflake CLI versions prior to 3.19 due to improper neutralization of parameters in certain command paths. An attacker can exploit this by supplying crafted values through socially engineered inputs, malicious repository configurations, or compromised automation pipelines that feed external values into the CLI. Successful exploitation allows the execution of unintended SQL commands in the context of the user's active Snowflake session, though the impact is constrained by the session's existing privileges. The vulnerability is addressed in Snowflake CLI version 3.19, which requires a manual upgrade by users.
Affected products
- Snowflake Snowflake CLI 1.1.0 to 3.18.x
Timeline
- 2026-06-29: disclosed
- 2026-06-29: advisory