CVE-2026-13752 Snowflake CLI SQL Injection Through Improper Neutralization of Parameters in Secret Creation and SPCS Service Log Commands

Improper neutralization of parameters in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. An attacker could exploit this by supplying crafted values to vulnerable command paths, causing Snowflake CLI to execute unintended SQL in the context of the user’s Snowflake session...

CVE-2026-13752

Snowflake CLI prior to v3.19 allows SQL injection via improper neutralization of parameters in certain command paths (e.g., secret creation and SPCS service log commands). An attacker could supply crafted values through vulnerable inputs or misconfigured/mined automation to reach vulnerable param...