Improper neutralization in the Snowpark annotation processor callback template in Snowflake CLI versions…

Snowflake CLI's snow snowpark build / nativeapp codegen snowpark pipeline scans Python source for Snowpark decorators (@udf, @sproc, etc.) and writes generator code from a callback template. Prior to 3.19.0, the annotation processor failed to neutralize attacker-controlled values pulled out of those decorators when interpolating them into the generated Python — a textbook CWE-94 template injection. Feed the CLI a Python file whose decorator arguments contain quote-breakouts and you get arbitrary code execution in the context of whoever ran the build. All Snowflake CLI builds < 3.19.0 are affected; 3.19.0 (released 2026-05-26) and later are patched.

Vendor's HIGH/8.8 is honest but slightly inflated by the AV:N tag. There is no listening service here — 'network' really means 'attacker-supplied content reaches the developer's box.' The UI:R requirement (a human or pipeline must actually invoke snow snowpark build) and the narrow installed base (Snowpark developers, not the whole Snowflake user population) argue for a small trim. But the role-multiplier in CI/CD and credentialed dev boxes is what holds this firmly in the HIGH bucket — see below.

Why this verdict

• Vendor baseline fair: 8.8 reflects a real arbitrary-code-execution primitive in a developer pipeline; not inflated.
• Friction adjustment −0.5: UI:R + non-listening service + installed base limited to Snowpark developers narrows realistic exposure vs. a true unauth network RCE.
• Friction adjustment −0.5: Most internal Snowpark projects build from trusted-only source; the malicious-PR vector requires either weak code review or accepting external PRs into the build pipeline.
• Role multiplier — CI/CD runner: Chain succeeds; blast radius is the runner's Snowflake credentials (often ACCOUNTADMIN-equivalent for the project warehouse) and any downstream consumers of the published Snowpark artifact → fleet-scale data egress / supply-chain pivot. This is the floor-setting role.
• Role multiplier — developer workstation: Chain succeeds; blast radius is the developer's local Snowflake config plus any cloud-CLI creds on the box → tenant-scope compromise.
• Role multiplier — analyst laptop running ad-hoc snow snowpark build: Chain succeeds but blast radius is limited to that user's role-scoped Snowflake credentials, no supply-chain leg.

Why not higher?

Not CRITICAL because (a) no listening network service — exploitation requires the victim to actively build attacker-controlled source, (b) the canonical Snowpark codegen footprint is a fraction of the Snowflake user base, not infrastructure-scale, and (c) no in-the-wild exploitation or public PoC at disclosure. Promote to CRITICAL only if a PoC drops AND your CI builds external-PR content.

Why not lower?

Not MEDIUM because the affected component canonically holds production Snowflake credentials on CI runners and lead-developer workstations; the role-multiplier floor for a credentialed data-plane pipeline is HIGH regardless of how narrow the trigger is. Friction reduces probability, not consequence.

1. Upgrade Snowflake CLI to ≥ 3.19.0 fleet-wide — The only true fix. Push via pip install --upgrade snowflake-cli in your dev-tooling baseline, brew formula bump, or the CI runner image rebuild. Per noisgate HIGH mitigation SLA, complete within 30 days; remediation (full version pin in lockfiles + image bake) within 180 days.
2. Block snow snowpark build / snow app codegen from running on untrusted PR content in CI — Until upgrade lands, gate the build step on github.event.pull_request.head.repo.full_name == github.repository (no fork PRs), or run untrusted PRs in a network-isolated sandbox with no Snowflake credentials mounted. Deploy within 30 days of disclosure.
3. Rotate Snowflake credentials accessible from any CI runner that built untrusted source in the last 90 days — Assume worst-case if you accept external PRs. Rotate key-pair private keys, OAuth client secrets, and any SNOWFLAKE_PASSWORD env values; reissue from HSM where possible.
4. Enforce Snowflake network policies (CREATE NETWORK POLICY) + MFA on all service users — Caps the blast radius if a token is stolen — exfiltrated creds become useless from an attacker IP.
5. Egress-allowlist CI runners — Outbound network from build runners should reach only your package registry, Snowflake endpoints, and source control. Stops the curl-pipe-sh stage cold.

Run on every developer workstation and CI runner that has Snowflake CLI installed. Invoke as bash check-cve-2026-13749.sh — no root required, just needs snow on PATH (or pip in the same venv).

#!/usr/bin/env bash
# check-cve-2026-13749.sh — Snowflake CLI Snowpark annotation processor RCE
# Exit codes: 0 PATCHED, 1 VULNERABLE, 2 UNKNOWN / not installed
set -u

FIXED_MAJOR=3
FIXED_MINOR=19
FIXED_PATCH=0

ver_raw=""
if command -v snow >/dev/null 2>&1; then
  ver_raw="$(snow --version 2>/dev/null | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+' | head -n1)"
fi

if [ -z "$ver_raw" ]; then
  # fall back to pip
  if command -v pip >/dev/null 2>&1; then
    ver_raw="$(pip show snowflake-cli 2>/dev/null | awk '/^Version:/ {print $2}')"
  fi
fi

if [ -z "$ver_raw" ]; then
  echo "UNKNOWN — Snowflake CLI not detected on this host"
  exit 2
fi

IFS='.' read -r MAJ MIN PAT <<<"$ver_raw"
MAJ=${MAJ:-0}; MIN=${MIN:-0}; PAT=${PAT:-0}

vulnerable=0
if [ "$MAJ" -lt "$FIXED_MAJOR" ]; then
  vulnerable=1
elif [ "$MAJ" -eq "$FIXED_MAJOR" ] && [ "$MIN" -lt "$FIXED_MINOR" ]; then
  vulnerable=1
elif [ "$MAJ" -eq "$FIXED_MAJOR" ] && [ "$MIN" -eq "$FIXED_MINOR" ] && [ "$PAT" -lt "$FIXED_PATCH" ]; then
  vulnerable=1
fi

if [ "$vulnerable" -eq 1 ]; then
  echo "VULNERABLE — snowflake-cli $ver_raw (< 3.19.0) — CVE-2026-13749"
  exit 1
fi

echo "PATCHED — snowflake-cli $ver_raw"
exit 0

Sources

1. Snowflake CLI 2026 release notes
2. Snowflake Security Bulletins
3. snowflakedb/snowflake-cli GitHub Releases
4. Snowflake CVE landing — OpenCVE
5. Snowflake Native App CVE guidance
6. Related: CVE-2026-6442 Cortex Code CLI RCE (comparable dev-tool class)
7. GHSA mirror for Snowflake CLI advisories
8. CWE-94: Improper Control of Generation of Code