CVE-2026-13744: falha de alta gravidade em Snowflake CLI
Snowflake CLI SQL Injection Through Improper Neutralization of User-Controlled Input
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.3epss 0.5%
Improper neutralization of attacker-controlled content in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. By supplying crafted repository content, project configuration, manifest data, or specification input, an attacker could cause Snowflake CLI to execute unintended SQL in the context of the victim user's Snowflake session. Successful exploitation requires the victim to process attacker-controlled content through a vulnerable command path and is limited by the privileges assigned to that session. The fix is available in Snowflake CLI version 3.19. Users must manually upgrade.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Produtos afetados
Snowflake · Snowflake CLICVEs relacionadas — Snowflake CLI
No mesmo produto, das mais perigosas para as menos.
CVE-2026-13749HIGHSnowflake CLI Arbitrary Code Execution via Snowpark Annotation Processor Template InjectionEPSS 0.5%CVE-2026-13752MEDIUMSnowflake CLI SQL Injection Through Improper Neutralization of Parameters in Secret Creation and SPCS Service Log CommandsEPSS 0.3%CVE-2026-13746LOWSnowflake CLI SQL Injection Through Improper Neutralization of Local CLI ParametersEPSS 0.2%CVE-2026-13751MEDIUMSnowflake CLI Server-Side Request Forgery via Arbitrary URL Fetch in !source/!loadEPSS 0.2%CVE-2026-92903HIGHImproper Input Validation in Snowflake CLI Versions Allow Unsanitized User-Controlled Values to be Interpolated into SQL StringsEPSS 0.2%CVE-2026-13748MEDIUMSnowflake CLI Arbitrary Local File Read and Exfiltration Through Improper File Path RestrictionEPSS 0.2%