Snowflake CLI Had a Code-Injection Flaw Before 3.19.0: Building a Malicious Project Can Take Over Your Machine

"Snowflake CLI," the official command-line tool for "Snowflake," the cloud service widely used for enterprise data analytics, carries a serious vulnerability before version 3.19.0. Simply building (assembling) or deploying a crafted project can run an attacker's program on the machine of the person doing the work (arbitrary code execution). The identifier is CVE-2026-13749, with a severity of CVSS 8.8 out of 10. Snowflake, the developer, published a security advisory, and the issue is fixed in version 3.19.0 and later; the latest as of July 2026 is 3.23.0. If your snow command is 3.19.0 or later, no further action is needed; if it is older, you need to update.

Snowflake CLI is the tool data professionals and engineers use from their own machines, via a local command (snow), to assemble and deploy apps and data processing on Snowflake. What makes this hole troublesome is that it requires no special privileges such as login, and is triggered by the everyday task of "building a project someone else prepared in your own environment." Rather than attacking Snowflake's servers directly, the attacker uses the developer's local work as a stepping stone.

*The update to the fixed 3.19.0 is not automatic; users must upgrade manually (release notes).

Who is at risk, and what is the damage

This hole can be exploited by an attacker who can get a data professional to build or deploy a booby-trapped Snowflake project. In practice, this covers running someone else's project in your own environment: a handy-looking sample or template in a public repository, a verification project attached to a technical article, a deliverable from an outsourcing partner, a boilerplate shared within a team. The attacker needs no Snowflake account or login — they just mix the trap into the project files.

The attacker slips project content into the program that Snowflake CLI auto-generates internally, so the attacker's code runs at the moment of building or deploying. To prepare data processing (Snowpark), the CLI assembles Python code behind the scenes, but it did not sufficiently neutralize the project descriptions used as the raw material — so the attacker's instructions end up mixed into the generated code and run. Execution happens with the privileges of the user doing the work.

The essence of the damage is that the machine of the person handling the data platform gets taken over. Such machines concentrate connection details and access tokens for Snowflake, cloud keys, and permissions to extract large volumes of data. Compromise one, and it can become a foothold to break into the data platform, exfiltrate confidential data, or even contaminate shipped artifacts (a supply-chain attack). Because the attack passes through a tool used in development and operations, it underscores the need to review the security of the software you depend on, all at once. Our OSS supply-chain scanner also covers the importance of inspecting these "weaknesses in foundational software." A command-line tool for a data platform becoming the entry point for takeover is the same family as the flaw in the workflow platform "Prefect" (CVE-2026-5366).

What Snowflake and its command-line tool are

Snowflake is a service (a cloud data platform) for storing large volumes of data in the cloud and analyzing it quickly. Many companies adopt it as the foundation for sales analysis, customer-data aggregation, and machine learning. One of the mechanisms for building apps and data processing on top of it is "Snowpark," which lets you transform data inside Snowflake using languages such as Python.

"Snowflake CLI" is the official tool for performing this work from a local command (snow). It can "build" a project and "deploy" it to Snowflake with a single command. To check whether you are affected, run snow --version and see whether it is older than 3.19.0. Versions from 2.4.0 up to before 3.19.0 are affected, and 3.19.0 or later is fixed (the latest as of July 2026 is 3.23.0). The main targets are data engineers and analytics professionals who work with Snowflake.

How it leads to takeover

When preparing Snowpark data processing, Snowflake CLI auto-generates "bridge" Python code based on information written in the project (the annotation processor mechanism). Values written on the project side should be treated safely as "data," but here they were embedded directly as part of the generated code — so when an attacker plants a code fragment inside a value, it runs as part of the legitimate code. This is the classic weakness known as "code injection" (CWE-94).

The trigger is the user running a build or deploy with snow against a project the attacker prepared. According to Snowflake, exploitation requires "running bundling or deployment workflows against attacker-controlled project content." Conversely, if you only handle projects made by you or a trusted team, an attack does not succeed outright. Version 3.19.0 reworked how these values are handled so they no longer slip into generated code, closing this hole. Snowflake CLI has kept releasing since then, and the latest as of July 2026 is 3.23.0, so moving to the latest version is the safe choice.

What to do now

The top priority is updating Snowflake CLI. Because updates are not applied automatically, you must upgrade manually. Depending on your install method, update with something like pip install --upgrade snowflake-cli, and confirm it is 3.19.0 or later (ideally the latest 3.23.0) with snow --version. If you use Snowflake CLI inside CI/CD (automated build and delivery), be sure to raise the version used there too.

If you cannot update right away, the interim defense is to not casually build or deploy Snowflake projects of unknown origin. Review received projects, and handle untrusted ones in an isolated environment (a disposable virtual machine or container) to limit the blast radius. If many people in your organization use Snowflake CLI, first identify which machines and automated processes still run old versions and update those first.

Summary

CVE-2026-13749 is a code injection flaw in "Snowflake CLI," Snowflake's official command-line tool. When a user builds or deploys an attacker-crafted project, the attacker's program runs on their machine and can lead to takeover. It is fixed in 3.19.0 and later (the latest as of July 2026 is 3.23.0), and because the update is manual, the key step is to check your environment's version and update.

Running projects made by others in your own environment is part of everyday data analysis and development. That is exactly why this is a good moment to both keep your tools up to date and revisit the habit of not casually running untrusted projects.

FAQ

References

• ・NVD — CVE-2026-13749
• ・Snowflake — Snowflake CLI Vulnerability Advisory
• ・snowflake-cli — release notes (3.19.0)
• ・snowflake-cli — project
• ・Snowflake — Snowflake CLI documentation
• ・MITRE — CWE-94 (Code Injection)