What is the CVSS score of CVE-2026-13752?

CVE-2026-13752 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Snowflake CLI are affected by CVE-2026-13752?

Snowflake CLI installations in versions 1.1.0-3.18.x are vulnerable to SQL injection that could compromise data integrity when trust boundaries are breached through social engineering or…. A patch is available.

How to fix or mitigate CVE-2026-13752?

Within 24 hours: Inventory all systems running Snowflake CLI versions 1.1.0-3.18.x. Within 7 days: Upgrade all instances to Snowflake CLI version 3.19 or later. Within 30 days: Verify patch compliance across the organization and audit Snowflake CLI access controls and session privilege boundaries.

Snowflake CLI CVE-2026-13752

EUVD-2026-40149 HIGH

SQL Injection (CWE-89)

2026-06-29 412d305a-227d-44f9-a262-a31ba44f2aea

GHSA-2jqx-3g86-5c63

SQLi Snowflake Cli

8.0

CVSS 3.1 · NVD

Severity by source

Vendor (412d305a-227d-44f9-a262-a31ba44f2aea) PRIMARY

MEDIUM

qualitative

NVD

8.0 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

Runs in an authenticated session so PR:L, and requires the victim to invoke the command with crafted input so UI:R; injected SQL yields full C/I/A within session scope.

3.1 AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (412d305a-227d-44f9-a262-a31ba44f2aea).

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jun 30, 2026 - 16:13 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 16:13 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 30, 2026 - 16:07 vuln.today

cvss_changed

Severity Changed

Jun 30, 2026 - 16:07 NVD

MEDIUM HIGH

CVSS changed

Jun 30, 2026 - 16:07 NVD

6.0 (MEDIUM) 8.0 (HIGH)

Patch available

Jun 29, 2026 - 19:01 EUVD

Analysis Generated

Jun 29, 2026 - 17:33 vuln.today

DescriptionNVD

Improper neutralization of parameters in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. An attacker could exploit this by supplying crafted values to vulnerable command paths, causing Snowflake CLI to execute unintended SQL in the context of the user’s Snowflake session. Successful exploitation required crafted values to reach vulnerable parameters, including through socially engineered input, malicious repository configuration, or compromised automation feeding external values into the CLI, and impact is limited by the privileges assigned to the active session. The fix is available in Snowflake CLI version 3.19, and users must manually upgrade.

AnalysisAI

SQL injection in Snowflake CLI versions 1.1.0 through 3.18.x (fixed in 3.19) lets crafted parameter values reach vulnerable command paths and execute unintended SQL within the user's active Snowflake session. An authenticated CLI user who is fed malicious input - via social engineering, a poisoned repository configuration, or compromised automation - can have arbitrary statements run against their session, with impact bounded by that session's privileges. No public exploit identified at time of analysis; EPSS is very low (0.11%, 1st percentile) and the SSVC exploitation status is 'none', so this is a not-yet-exploited but high-technical-impact issue.

Technical ContextAI

Snowflake CLI is the official command-line client for interacting with the Snowflake data cloud, issuing SQL and managing objects, apps, and automation against a connected Snowflake session. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user- or config-supplied parameter values are not properly sanitized or parameterized before being incorporated into SQL the CLI submits to Snowflake. The affected component per CPE is cpe:2.3:a:snowflake:snowflake_cli, and because the injected SQL runs inside the operator's already-authenticated session, the blast radius is whatever roles and grants that session holds.

RemediationAI

Vendor-released patch: Snowflake CLI version 3.19.0 - upgrade all installations to 3.19 or later, noting that the fix is not automatic and users must manually upgrade per the vendor advisory at https://community.snowflake.com/s/article/Snowflake-CLI-Vulnerability-Advisory. Until upgraded, reduce risk by not passing untrusted or externally-controlled values into CLI command parameters: treat repository configuration files and CI/CD-supplied variables as untrusted input, review automation that feeds external data into the CLI, and run the CLI under Snowflake sessions scoped to least-privilege roles so that any unintended SQL is bounded by minimal grants (trade-off: tighter role scoping may break workflows that rely on broad privileges and requires reviewing role assignments). Avoid using sessions with elevated roles (e.g., ACCOUNTADMIN) for routine or automated CLI operations.