CVE-2026-13748

{
  "id": "CVE-2026-13748",
  "sourceIdentifier": "412d305a-227d-44f9-a262-a31ba44f2aea",
  "published": "2026-06-29T16:16:39.517",
  "lastModified": "2026-10-25T21:10:00.770",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper restriction of file path resolution in Snowflake CLI versions prior to 3.19 allowed arbitrary local file content to be read and transmitted to Snowflake services. An attacker could exploit this by supplying crafted repository or project content that referenced files outside the intended project boundary, causing Snowflake CLI to read local files and upload or embed their contents during deployment or SQL template processing. Successful exploitation required the victim to process attacker-controlled project content, and retrieval of exfiltrated data depended on access to the victim's Snowflake account artifacts such as query history or uploaded stage content. The fix is available in Snowflake CLI version 3.19, and users must manually upgrade."
    },
    {
      "lang": "es",
      "value": "La restricción inadecuada de la resolución de rutas de archivo en las versiones de Snowflake CLI anteriores a la 3.19 permitía que se leyera contenido arbitrario de archivos locales y se transmitiera a los servicios de Snowflake. Un atacante podría explotar esto al proporcionar contenido de repositorio o proyecto manipulado que hiciera referencia a archivos fuera del límite del proyecto previsto, lo que provocaría que Snowflake CLI leyera archivos locales y cargara o incrustara su contenido durante la implementación o el procesamiento de plantillas SQL. La explotación exitosa requería que la víctima procesara contenido de proyecto controlado por el atacante, y la recuperación de datos exfiltrados dependía del acceso a los artefactos de la cuenta de Snowflake de la víctima, como el historial de consultas o el contenido de stage cargado. La solución está disponible en la versión 3.19 de Snowflake CLI, y los usuarios deben actualizar manualmente."
    }
  ],
  "affected": [
    {
      "source": "412d305a-227d-44f9-a262-a31ba44f2aea",
      "affectedData": [
        {
          "vendor": "Snowflake",
          "product": "Snowflake CLI",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0.2.2",
              "lessThan": "3.19.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "412d305a-227d-44f9-a262-a31ba44f2aea",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 4.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-29T16:20:50.026529Z",
          "id": "CVE-2026-13748",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "412d305a-227d-44f9-a262-a31ba44f2aea",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        },
        {
          "lang": "en",
          "value": "CWE-61"
        },
        {
          "lang": "en",
          "value": "CWE-73"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:snowflake:snowflake_cli:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "0.2.2",
              "versionEndExcluding": "3.19.0",
              "matchCriteriaId": "B7273C8A-C77C-47EC-8269-5C8542894BE4"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://community.snowflake.com/s/article/Snowflake-CLI-Vulnerability-Advisory",
      "source": "412d305a-227d-44f9-a262-a31ba44f2aea",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}