CVE-2026-13748: Improper Limitation of a Pathname to a Restricted Directory

Improper restriction of file path resolution in Snowflake CLI versions prior to 3.19 allowed arbitrary local file content to be read and transmitted to Snowflake services. An attacker could exploit this by supplying crafted repository or project content that referenced files outside the intended...

PT-2026-53310

Name of the Vulnerable Software and Affected Versions Snowflake CLI versions prior to 3.19 Description Improper neutralization of local CLI parameters allows unintended SQL execution. A user can trigger this issue by providing crafted values to the Cortex SQL or object listing command paths,...

hyperpod-elastic-agent (>=1.1.0, <=1.1.3), jupyter-quant (>=2509.1.0, <=2510.1.0) +5 more potentially affected by CVE-2026-8643 via pip (25.2.0)

pip PYPI version 25.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - hyperpod-elastic-agent =1.1.0, =2509.1.0, =0.1.0, =0.20.0, =3.13.0, =3.13.0, =3.14.0 Source cves: CVE-2026-8643 Source advisory: OSV:GHSA-WF93-45JW-7689...

hyperpod-elastic-agent (>=1.1.0, <=1.1.3), jupyter-quant (>=2509.1.0, <=2510.1.0) +5 more potentially affected by CVE-2026-3219 via pip (25.2.0)

pip PYPI version 25.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - hyperpod-elastic-agent =1.1.0, =2509.1.0, =0.1.0, =0.20.0, =3.13.0, =3.13.0, =3.14.0 Source cves: CVE-2026-3219 Source advisory: OSV:GHSA-58QW-9MGM-455V...

hyperpod-elastic-agent (>=1.1.0, <=1.1.3), jupyter-quant (>=2509.1.0, <=2510.1.0) +5 more potentially affected by CVE-2026-1703 via pip (25.2.0)

pip PYPI version 25.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - hyperpod-elastic-agent =1.1.0, =2509.1.0, =0.1.0, =0.20.0, =3.13.0, =3.13.0, =3.14.0 Source cves: CVE-2026-1703 Source advisory: OSV:GHSA-6VGW-5PG2-W6JP...

snowflake-cli-labs (3.0.0rc1) potentially affected by CVE-2025-47273 via setuptools (74.1.0)

setuptools PYPI version 74.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - snowflake-cli-labs 3.0.0rc1 Source cves: CVE-2025-47273 Source advisory: OSV:GHSA-5RJG-FVGR-3XXF...

snowflake-cli-labs (3.0.0rc1) potentially affected by CVE-2025-47273 via setuptools (74.1.0)

setuptools PYPI version 74.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - snowflake-cli-labs 3.0.0rc1 Source cves: CVE-2025-47273 Source advisory: OSV:PYSEC-2025-49...