CVE-2026-13744

The record

Improper neutralization of attacker-controlled content in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. By supplying crafted repository content, project configuration, manifest data, or specification input, an attacker could cause Snowflake CLI to execute unintended SQL in the context of the victim user's Snowflake session. Successful exploitation requires the victim to process attacker-controlled content through a vulnerable command path and is limited by the privileges assigned to that session. The fix is available in Snowflake CLI version 3.19. Users must manually upgrade.

Affected packages

Related vulnerabilities

• CVE-2026-63224 OpenRemote is an open-source internet-of-things platform. CWE-89
• CVE-2026-62849 ThingLinks is an enterprise IoT platform. CWE-89
• CVE-2026-61620 HoneySQL turns Clojure data structures into SQL. CWE-89
• CVE-2026-39732 Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions. CWE-89
• CVE-2026-119619 A vulnerability was found in 37954679 cak-filemanagement-system up to… CWE-89
• CVE-2026-115820 The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for… CWE-89
• CVE-2026-119656 CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection… CWE-89
• CVE-2026-119655 CoreShop through 1.5.5 contains an unauthenticated sql injection vulnerability in the… CWE-89