EUVD-2026-23292
GHSA-26fh-vcwc-mcgv
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Untrusted remote content plus required user action and non-deterministic model behavior give AV:N/UI:R/AC:H; sandbox escape is S:C with total local C/I/A impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
Improper validation of bash commands in Snowflake Cortex Code CLI versions prior to 1.0.25 allowed subsequent commands to execute outside the sandbox. An attacker could exploit this by embedding specially crafted commands in untrusted content, such as a malicious repository, causing the CLI agent to execute arbitrary code on the local device without user consent. Exploitation is non-deterministic and model-dependent. The fix is automatically applied upon relaunch with no user action required.
AnalysisAI
Sandbox escape leading to arbitrary local code execution affects Snowflake Cortex Code CLI (an AI coding agent) in all versions prior to 1.0.25. Because the CLI improperly validates bash commands, an attacker who plants specially crafted content in untrusted material-such as a malicious repository-can cause the agent to run subsequent commands outside its sandbox and execute arbitrary code on the user's device without consent. No public exploit identified at time of analysis; EPSS is low (0.07%) and exploitation is non-deterministic and model-dependent, so real-world reliability is limited.
Technical ContextAI
Cortex Code CLI is Snowflake's agentic command-line coding assistant that executes shell (bash) commands on behalf of an LLM within a sandbox intended to contain those actions. The root cause maps to CWE-1286 (Improper Validation of Syntactic Correctness of Input): the CLI parses and validates bash commands incorrectly, so command syntax that should be confined to the sandbox can chain or terminate into subsequent commands that run outside it. This is a classic AI-agent command-injection / sandbox-bypass pattern where prompt-injected content in a repository (README, source comments, or files the agent is asked to analyze) is transformed by the model into shell actions, and flawed validation lets those actions break out. The single affected CPE is cpe:2.3:a:snowflake:cortex_code_cli:*:*:*:*:*:*:*:*.
RemediationAI
Vendor-released patch: version 1.0.25. Update Cortex Code CLI to 1.0.25 or later; per the vendor the fix is automatically applied upon relaunch with no user action required, so ensure users fully restart the CLI to pick it up. Verify the running build reports 1.0.25+ across all developer machines and any CI/automation that invokes the agent. As interim compensating controls until relaunch, avoid pointing the CLI at untrusted or third-party repositories and treat any repo you did not author as potentially hostile content (trade-off: restricts legitimate exploratory use); run the agent inside an OS-level container or disposable VM with no sensitive credentials and restricted network egress so an escape is contained (trade-off: added setup, reduced convenience); and require human review of agent-proposed shell commands instead of auto-approving them (trade-off: slows the agentic workflow). See the Snowflake advisory (https://community.snowflake.com/s/article/PromptArmor-Report---Snowflake-Response) and NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-6442).
Share
External POC / Exploit Code
Leaving vuln.today