CVE-2026-13746

Improper neutralization of local CLI parameters in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. A user could trigger this issue by supplying crafted values to vulnerable Cortex SQL or object listing command paths, causing Snowflake CLI to execute unintended SQL in the context of that user's Snowflake session. Successful exploitation is constrained to self-injection because the vulnerable parameters were supplied directly through local CLI arguments rather than through project files, repositories, or other external input sources, and impact is limited to the privileges already available to the current session. The fix is available in Snowflake CLI version 3.19, and users must manually upgrade.

• CWE-89

• https://community.snowflake.com/s/article/Snowflake-CLI-Vulnerability-AdvisoryVendor Advisory

Published

Jun 29, 2026

Last Modified

Jun 30, 2026

Status

Analyzed

• CVE-2026-1373The Easy Author Image plugin for WordPress is vulnerable to …6.4
• CVE-2026-13731The WPBot – AI ChatBot for Live Support, Lead Generation, AI…7.2
• CVE-2026-13733The Download Manager plugin for WordPress is vulnerable to S…6.4
• CVE-2026-13742Honeywell IQ MultiAccess, all versions prior to and includin…5.9
• CVE-2026-13743CubeSpace CW0057 Reaction Wheel firmware versions prior to 5…3.3
• CVE-2026-13744Improper neutralization of attacker-controlled content in Sn…8.8
• CVE-2026-13748Improper restriction of file path resolution in Snowflake CL…6.3
• CVE-2026-13749Improper neutralization in the Snowpark annotation processor…8.8
• CVE-2026-1375The Tutor LMS – eLearning and online course solution plugin …8.1
• CVE-2026-13750Insertion of sensitive information into log files in Snowfla…5.5
• CVE-2026-13751Improper handling of untrusted remote references in Snowflak…9.6
• CVE-2026-13752Improper neutralization of parameters in Snowflake CLI versi…8