CVE-2026-13749: Snowflake CLI Code Injection Vulnerability in Snowpark Annotation Processor

Technical summary

CVE-2026-13749 is a code injection vulnerability in the Snowpark annotation processor callback template used by Snowflake CLI. The vulnerability stems from improper neutralization of untrusted input during Python code generation. When a user runs the CLI's bundling or deployment workflow, attacker-supplied project content is interpolated directly into generated Python code without adequate sanitization. This results in arbitrary code execution in the local execution context with the privileges of the user invoking the CLI. The vulnerability affects all versions prior to 3.19, where the fix has been implemented.

Business impact

This vulnerability poses a significant risk to development teams and DevOps personnel who use Snowflake CLI. Successful exploitation can lead to unauthorized access to local development environments, theft of credentials or source code, lateral movement into connected systems, and compromise of the CI/CD pipeline if the CLI is executed in automated workflows. Organizations deploying Snowflake applications should prioritize upgrading to mitigate the risk of developer machine compromise and potential supply-chain contamination.

Affected systems

Snowflake CLI versions prior to 3.19 are affected. The vulnerability is triggered specifically during application bundling or deployment operations. Any developer or automated system using an affected version to process project content is at risk. Users should verify their current CLI version and plan immediate upgrades to version 3.19 or later.

Exploitability

Exploitation requires user interaction—the victim must run the bundling or deployment workflow against attacker-controlled project content. The attack vector is network-accessible (an attacker can host or distribute malicious projects), there are no special privileges required to trigger it, and complexity is low. The CVSS 3.1 score of 8.8 (HIGH) reflects the high impact (confidentiality, integrity, and availability compromised) and the relative ease of exploitation once the victim is socially engineered or compromised to process untrusted project files. The vulnerability has not yet been added to the CISA Known Exploited Vulnerabilities catalog.

Remediation

Organizations must upgrade Snowflake CLI to version 3.19 or later. Manual upgrade is required; no automatic patching is available. Teams should verify the upgrade was successful and communicate the requirement to all developers and automation systems using the CLI. Consider implementing process controls to audit and restrict bundling/deployment operations to trusted, internally-sourced projects only.

Patch guidance

Upgrade Snowflake CLI to version 3.19 or later. Visit the Snowflake CLI release page or use your package manager to pull the latest version. After upgrading, verify the version using `snowflake --version` or the equivalent command for your installation method. If CLI is used in CI/CD pipelines or automated deployments, ensure all agents and containers are updated to the patched version before resuming production workflows.

Detection guidance

Monitor for unusual process execution or code generation activity when Snowflake CLI runs, particularly in bundling or deployment phases. Review CLI logs and project file history for unexpected changes or externally sourced content. In CI/CD environments, log all CLI invocations and their source projects. Consider scanning project repositories and dependency sources for suspicious modifications. Behavioral detection may flag unexpected child processes spawned during CLI execution, especially if they attempt to access credentials, environment variables, or network resources.

Why prioritize this

This vulnerability merits immediate attention due to its HIGH severity, the ease of exploitation once a victim processes malicious content, and the potential for widespread impact on development infrastructure and supply chains. The attack surface spans any developer or automation system using the CLI, making it a credible concern for organizations with significant Snowflake deployments. The requirement for user interaction is the primary limiting factor, but social engineering and supply-chain attacks can effectively overcome this hurdle.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects high impact across confidentiality, integrity, and availability (all marked as High), combined with low attack complexity and no privilege requirements. The user interaction requirement prevents a perfect score, but the network attack vector and lack of scope change keep the overall severity in the HIGH range. Organizations with developer-facing threat models and supply-chain concerns should treat this as a critical upgrade priority.

Frequently asked questions