EUVD-2026-40135
GHSA-gxp8-hq7m-332h
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Malicious content is delivered over the network (AV:N) but requires the victim to run the bundling workflow (UI:R); attacker needs no privileges (PR:N), and injected code yields full local C/I/A impact.
Primary rating from Vendor (SNOWFLAKE).
CVSS VectorVendor: SNOWFLAKE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Improper neutralization in the Snowpark annotation processor callback template in Snowflake CLI versions prior to 3.19 allowed arbitrary code execution during application bundling or deployment. An attacker could exploit this by supplying crafted project content that is interpolated into generated Python code, causing Snowflake CLI to execute attacker-controlled code in the local context of the user running the CLI. Successful exploitation requires the victim to run the relevant bundling or deployment workflow against attacker-controlled project content, and any resulting code runs with the privileges of that local execution context. The fix is available in Snowflake CLI version 3.19, and users must manually upgrade.
Articles & Coverage 2
AnalysisAI
Arbitrary code execution in Snowflake CLI versions prior to 3.19 lets an attacker run code in the context of any developer who bundles or deploys an attacker-supplied Snowpark project. The flaw lives in the Snowpark annotation processor callback template, where untrusted project content is interpolated directly into generated Python code (CWE-94). No public exploit has been identified at time of analysis, but the attack is straightforward and high-impact (CVSS 8.8) given that it executes with the victim's local privileges; exploitation hinges on the victim running the bundling/deployment workflow against malicious content.
Technical ContextAI
Snowflake CLI (cpe:2.3:a:snowflake:snowflake_cli) is the official command-line tool for building, bundling, and deploying Snowflake applications, including Snowpark Python apps. During bundling/deployment the CLI generates Python source from templates - specifically an annotation processor callback template for Snowpark. The root cause is CWE-94 (Improper Control of Generation of Code / code injection): project-controlled values are concatenated/interpolated into the generated Python without proper neutralization, so attacker-chosen strings become executable code rather than inert data. When the generated module is produced and run, the injected Python executes in the local interpreter the developer is using.
RemediationAI
Vendor-released patch: Snowflake CLI version 3.19 - upgrade manually, as the advisory notes the update is not automatic. Verify the installed version after upgrading (e.g., via your package manager or 'snow --version') across all developer machines and CI runners that build or deploy Snowpark apps. Until every host is on 3.19, only run bundling or deployment workflows against project content you fully trust: avoid bundling/deploying third-party, forked, or untrusted Snowpark projects, and review project files (especially annotation/decorator content feeding the Snowpark processor) before running 'snow' build/deploy commands. As a containment trade-off, run untrusted bundling in an isolated sandbox or ephemeral container with minimal credentials so any injected code cannot reach production Snowflake secrets or the developer's broader environment. Full details: https://community.snowflake.com/s/article/Snowflake-CLI-Vulnerability-Advisory.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Same weakness CWE-94 – Code Injection
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today