Vulnerability	Vulnerable Version
M SQL Injection snowflake-cli is a Snowflake CLI Affected versions of this package are vulnerable to SQL Injection via the `process` that interpolates user-controlled values into SQL strings. An attacker can execute arbitrary SQL statements in the context of the victim's session and active role by providing a malicious project configuration file or crafting specific command-line input. This is only exploitable if the attacker has write or pull-request access to a project repository whose CI/CD pipeline runs the CLI under an elevated service account role, or can supply untrusted input to CLI-wrapping automation. How to fix SQL Injection? Upgrade `snowflake-cli` to version 3.27.0 or higher.	[,3.27.0)

SQL Injection

snowflake-cli is a Snowflake CLI

Affected versions of this package are vulnerable to SQL Injection via the process that interpolates user-controlled values into SQL strings. An attacker can execute arbitrary SQL statements in the context of the victim's session and active role by providing a malicious project configuration file or crafting specific command-line input. This is only exploitable if the attacker has write or pull-request access to a project repository whose CI/CD pipeline runs the CLI under an elevated service account role, or can supply untrusted input to CLI-wrapping automation.

How to fix SQL Injection?

Upgrade snowflake-cli to version 3.27.0 or higher.

[,3.27.0)

Go back to all versions of this package