# CVE-2026-13744: Snowflake CLI SQL Injection Through Improper Neutralization of User-Controlled Input

> CVE-2026-13744: Snowflake CLI SQL Injection Through Improper Neutralization of User-Controlled Input. CVSS 8.3 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-13744
Last updated: 2026-10-25T21:10:00Z

- Published: 2026-06-29 15:40 UTC · Updated: 2026-10-25 21:10 UTC · Assigner: SNOWFLAKE
- CVSS: 8.3 (CVSS 3.1) · Severity: High · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
- EPSS: 0.47%, 40th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-89

## Description

Improper neutralization of attacker-controlled content in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. By supplying crafted repository content, project configuration, manifest data, or specification input, an attacker could cause Snowflake CLI to execute unintended SQL in the context of the victim user's Snowflake session. Successful exploitation requires the victim to process attacker-controlled content through a vulnerable command path and is limited by the privileges assigned to that session. The fix is available in Snowflake CLI version 3.19. Users must manually upgrade.

## Affected vendors and products

- Snowflake: Snowflake CLI

## Tracked companies

- [Snowflake](https://rewindex.com/company/snowflake.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-13744)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-13744)
- [https://community.snowflake.com/s/article/Snowflake-CLI-Vulnerability-Advisory](https://community.snowflake.com/s/article/Snowflake-CLI-Vulnerability-Advisory)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-13744 · Markdown: https://rewindex.com/cve/CVE-2026-13744.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-13744 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:10:07.469Z