CVE-2026-13744

Name of the Vulnerable Software and Affected Versions Snowflake CLI versions prior to 3.19

Description Improper neutralization of attacker-controlled content allows unintended SQL execution. An attacker can execute arbitrary SQL within the context of a victim user's Snowflake session by providing crafted repository content, project configuration, manifest data, or specification input. Exploitation occurs when a victim processes this malicious content through a vulnerable command path, and the impact is limited by the privileges assigned to the active session.

Recommendations Upgrade to version 3.19.