What is the CVSS score of EUVD-2026-23292?

EUVD-2026-23292 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Cortex Code CLI are affected by EUVD-2026-23292?

Snowflake Cortex Code CLI versions before 1.0.25 contain a sandbox escape allowing arbitrary code execution on developer machines if users process malicious repositories through the tool.. A patch is available.

How to fix or mitigate EUVD-2026-23292?

Within 24 hours: inventory all installations of Cortex Code CLI versions prior to 1.0.25 and identify affected developer users. Within 7 days: deploy mandatory upgrade to version 1.0.25 or later across all development environments and distribute guidance requiring developers to vet repository sources before use with Cortex Code CLI. Within 30 days: verify patch deployment completion through asset management systems and evaluate whether code review processes can reduce developer reliance on executing external code suggestions.

Cortex Code CLI EUVD-2026-23292

| CVE-2026-6442 HIGH

Improper Validation of Syntactic Correctness of Input (CWE-1286)

2026-04-16 SNOWFLAKE

GHSA-26fh-vcwc-mcgv

RCE Cortex Code Cli Snowflake

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Untrusted remote content plus required user action and non-deterministic model behavior give AV:N/UI:R/AC:H; sandbox escape is S:C with total local C/I/A impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 07:27 vuln.today

Patch released

Apr 17, 2026 - 15:38 nvd

Patch available

Apr 16, 2026 - 20:31 EUVD

EUVD ID Assigned

Apr 16, 2026 - 19:15 euvd

EUVD-2026-23292

CVE Published

Apr 16, 2026 - 18:43 nvd

HIGH 8.3

DescriptionCVE.org

Improper validation of bash commands in Snowflake Cortex Code CLI versions prior to 1.0.25 allowed subsequent commands to execute outside the sandbox. An attacker could exploit this by embedding specially crafted commands in untrusted content, such as a malicious repository, causing the CLI agent to execute arbitrary code on the local device without user consent. Exploitation is non-deterministic and model-dependent. The fix is automatically applied upon relaunch with no user action required.

AnalysisAI

Sandbox escape leading to arbitrary local code execution affects Snowflake Cortex Code CLI (an AI coding agent) in all versions prior to 1.0.25. Because the CLI improperly validates bash commands, an attacker who plants specially crafted content in untrusted material-such as a malicious repository-can cause the agent to run subsequent commands outside its sandbox and execute arbitrary code on the user's device without consent. No public exploit identified at time of analysis; EPSS is low (0.07%) and exploitation is non-deterministic and model-dependent, so real-world reliability is limited.

Technical ContextAI

Cortex Code CLI is Snowflake's agentic command-line coding assistant that executes shell (bash) commands on behalf of an LLM within a sandbox intended to contain those actions. The root cause maps to CWE-1286 (Improper Validation of Syntactic Correctness of Input): the CLI parses and validates bash commands incorrectly, so command syntax that should be confined to the sandbox can chain or terminate into subsequent commands that run outside it. This is a classic AI-agent command-injection / sandbox-bypass pattern where prompt-injected content in a repository (README, source comments, or files the agent is asked to analyze) is transformed by the model into shell actions, and flawed validation lets those actions break out. The single affected CPE is cpe:2.3:a:snowflake:cortex_code_cli:*:*:*:*:*:*:*:*.

RemediationAI

Vendor-released patch: version 1.0.25. Update Cortex Code CLI to 1.0.25 or later; per the vendor the fix is automatically applied upon relaunch with no user action required, so ensure users fully restart the CLI to pick it up. Verify the running build reports 1.0.25+ across all developer machines and any CI/automation that invokes the agent. As interim compensating controls until relaunch, avoid pointing the CLI at untrusted or third-party repositories and treat any repo you did not author as potentially hostile content (trade-off: restricts legitimate exploratory use); run the agent inside an OS-level container or disposable VM with no sensitive credentials and restricted network egress so an escape is contained (trade-off: added setup, reduced convenience); and require human review of agent-proposed shell commands instead of auto-approving them (trade-off: slows the agentic workflow). See the Snowflake advisory (https://community.snowflake.com/s/article/PromptArmor-Report---Snowflake-Response) and NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-6442).