CVE-2026-13752

Improper neutralization of parameters in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. An attacker could exploit this by supplying crafted values to vulnerable command paths, causing Snowflake CLI to execute unintended SQL in the context of the user’s Snowflake session. Successful exploitation required crafted values to reach vulnerable parameters, including through socially engineered input, malicious repository configuration, or compromised automation feeding external values into the CLI, and impact is limited by the privileges assigned to the active session. The fix is available in Snowflake CLI version 3.19, and users must manually upgrade.

• CWE-89

• https://community.snowflake.com/s/article/Snowflake-CLI-Vulnerability-AdvisoryVendor Advisory

Published

Jun 29, 2026

Last Modified

Jun 30, 2026

Status

Analyzed

• CVE-2026-13746Improper neutralization of local CLI parameters in Snowflake…5.4
• CVE-2026-13748Improper restriction of file path resolution in Snowflake CL…6.3
• CVE-2026-13749Improper neutralization in the Snowpark annotation processor…8.8
• CVE-2026-1375The Tutor LMS – eLearning and online course solution plugin …8.1
• CVE-2026-13750Insertion of sensitive information into log files in Snowfla…5.5
• CVE-2026-13751Improper handling of untrusted remote references in Snowflak…9.6
• CVE-2026-13753A missing authorization vulnerability exists in the embedded…7.5
• CVE-2026-13756The WP Grid Builder plugin for WordPress is vulnerable to Pr…8.8
• CVE-2026-13757A flaw was found in p11-kit. The RPC message attribute parsi…6.2
• CVE-2026-13758CryptX versions before 0.088_001 for Perl compare AEAD authe…3.7
• CVE-2026-13759IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 ships th…8.8
• CVE-2026-1376IBM i 7.6 could allow a remote attacker to cause a denial of…7.5