Snowflake CLI Snowpark annotation processor callback-template code injection (RCE)

Snowflake CLI's snow snowpark build / nativeapp codegen snowpark pipeline scans Python source for Snowpark decorators (@udf, @sproc, etc.) and writes generator code from a callback template. Prior to 3.19.0, the annotation processor failed to neutralize attacker-controlled values pulled out of those decorators when interpolating them into the generated Python — a textbook CWE-94 template injection. Feed the CLI a Python file whose decorator arguments contain quote-breakouts and you get arbitrary code execution in the context of whoever ran the build. All Snowflake CLI builds < 3.19.0 are affected; 3.19.0 (released 2026-05-26) and later are patched.

Vendor's HIGH/8.8 is honest but slightly inflated by the AV:N tag. There is no listening service here — 'network' really means 'attacker-supplied content reaches the developer's box.' The UI:R requirement (a human or pipeline must actually invoke snow snowpark build) and the narrow installed base (Snowpark developers, not the whole Snowflake user population) argue for a small trim. But the role-multiplier in CI/CD and credentialed dev boxes is what holds this firmly in the HIGH bucket — see below.

Sources.

1. Snowflake CLI 2026 release notes
2. Snowflake Security Bulletins
3. snowflakedb/snowflake-cli GitHub Releases
4. Snowflake CVE landing — OpenCVE
5. Snowflake Native App CVE guidance
6. Related: CVE-2026-6442 Cortex Code CLI RCE (comparable dev-tool class)
7. GHSA mirror for Snowflake CLI advisories
8. CWE-94: Improper Control of Generation of Code

Run on every developer workstation and CI runner that has Snowflake CLI installed. Invoke as bash check-cve-2026-13749.sh — no root required, just needs snow on PATH (or pip in the same venv).

#!/usr/bin/env bash
# check-cve-2026-13749.sh — Snowflake CLI Snowpark annotation processor RCE
# Exit codes: 0 PATCHED, 1 VULNERABLE, 2 UNKNOWN / not installed
set -u

FIXED_MAJOR=3
FIXED_MINOR=19
FIXED_PATCH=0

ver_raw=""
if command -v snow >/dev/null 2>&1; then
  ver_raw="$(snow --version 2>/dev/null | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+' | head -n1)"
fi

if [ -z "$ver_raw" ]; then
  # fall back to pip
  if command -v pip >/dev/null 2>&1; then
    ver_raw="$(pip show snowflake-cli 2>/dev/null | awk '/^Version:/ {print $2}')"
  fi
fi

if [ -z "$ver_raw" ]; then
  echo "UNKNOWN — Snowflake CLI not detected on this host"
  exit 2
fi

IFS='.' read -r MAJ MIN PAT <<<"$ver_raw"
MAJ=${MAJ:-0}; MIN=${MIN:-0}; PAT=${PAT:-0}

vulnerable=0
if [ "$MAJ" -lt "$FIXED_MAJOR" ]; then
  vulnerable=1
elif [ "$MAJ" -eq "$FIXED_MAJOR" ] && [ "$MIN" -lt "$FIXED_MINOR" ]; then
  vulnerable=1
elif [ "$MAJ" -eq "$FIXED_MAJOR" ] && [ "$MIN" -eq "$FIXED_MINOR" ] && [ "$PAT" -lt "$FIXED_PATCH" ]; then
  vulnerable=1
fi

if [ "$vulnerable" -eq 1 ]; then
  echo "VULNERABLE — snowflake-cli $ver_raw (< 3.19.0) — CVE-2026-13749"
  exit 1
fi

echo "PATCHED — snowflake-cli $ver_raw"
exit 0