Answer in brief
CVE-2026-13748 records a Medium severity (CVSS 6.3) vulnerability in Snowflake CLI Arbitrary Local File Read and Exfiltration Through Improper File Path Restriction. The current sources do not mark it as known exploited. The current feed maps Snowflake/Snowflake CLI (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Snowflake/Snowflake CLI (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Snowflake/Snowflake CLIgeneric | >=0.2.2 <3.19.0 | 3.19.0 |
Published upstream
Jun 29, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jun 30, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 29, 2026
Improper restriction of file path resolution in Snowflake CLI versions prior to 3.19 allowed arbitrary local file content to be read and transmitted to Snowflake services. An attacker could exploit this by supplying crafted repository or project content that referenced files outside the intended project boundary, causing Snowflake CLI to read local files and upload or embed their contents during deployment or SQL template processing. Successful exploitation required the victim to process attacker-controlled project content, and retrieval of exfiltrated data depended on access to the victim's Snowflake account artifacts such as query history or uploaded stage content. The fix is available in Snowflake CLI version 3.19, and users must manually upgrade.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-13748 records a Medium severity (CVSS 6.3) vulnerability in Snowflake CLI Arbitrary Local File Read and Exfiltration Through Improper File Path Restriction. The current sources do not mark it as known exploited. The current feed maps Snowflake/Snowflake CLI (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Snowflake/Snowflake CLI (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Snowflake/Snowflake CLIgeneric | >=0.2.2 <3.19.0 | 3.19.0 |
Published upstream
Jun 29, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jun 30, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 29, 2026
Improper restriction of file path resolution in Snowflake CLI versions prior to 3.19 allowed arbitrary local file content to be read and transmitted to Snowflake services. An attacker could exploit this by supplying crafted repository or project content that referenced files outside the intended project boundary, causing Snowflake CLI to read local files and upload or embed their contents during deployment or SQL template processing. Successful exploitation required the victim to process attacker-controlled project content, and retrieval of exfiltrated data depended on access to the victim's Snowflake account artifacts such as query history or uploaded stage content. The fix is available in Snowflake CLI version 3.19, and users must manually upgrade.
Quoted source text, attributed separately from HOL analysis.