PT-2026-53311 · Snowflake · Snowflake Cli

Published 2026-06-29 · Updated 2026-06-29 · CVE-2026-13748

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Snowflake CLI versions prior to 3.19

Description Improper restriction of file path resolution allows arbitrary local file content to be read and transmitted to Snowflake services. An attacker can exploit this by providing crafted repository or project content that references files outside the intended project boundary. This causes the CLI to read local files and upload or embed their contents during SQL template processing or deployment. Successful exploitation requires the victim to process attacker-controlled project content, and the retrieval of exfiltrated data depends on access to the victim's Snowflake account artifacts, such as uploaded stage content or query history.

Recommendations Upgrade to Snowflake CLI version 3.19.

Fix

Path traversal

Weakness Enumeration

CWE-61

CWE-73

CWE-22

Related Identifiers

CVE-2026-13748

Affected Products

Snowflake Cli

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-13748 · Security Note
• https://community.snowflake.com/s/article/Snowflake-CLI-Vulnerability-Advisory · Note
• https://twitter.com/VulmonFeeds/status/2071635878192066918 · Twitter Post