snowflake-cli 3.5.0

Direct Vulnerabilities

Known vulnerabilities in the snowflake-cli package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Server-side Request Forgery (SSRF) snowflake-cli is a Snowflake CLI Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the `!source` or `!load` directives, which allow referencing remote URLs that are fetched at runtime without sufficient restriction on the request destination. An attacker can trigger unintended outbound requests from the victim's environment to internal or non-public network locations, and potentially cause remote SQL content to be retrieved and executed in the context of the victim user's session by supplying crafted SQL content processed through a vulnerable command path. This is only exploitable if the victim processes attacker-controlled content through a vulnerable command path. How to fix Server-side Request Forgery (SSRF)? Upgrade `snowflake-cli` to version 3.19.0 or higher.	[,3.19.0)
M SQL Injection snowflake-cli is a Snowflake CLI Affected versions of this package are vulnerable to SQL Injection via improper neutralization of parameters in the `secret` creation and `spcs` service log commands. An attacker can execute unintended SQL statements by supplying crafted input to vulnerable command paths. This is only exploitable if crafted values are provided to the affected parameters, such as through socially engineered input, malicious repository configuration, or compromised automation feeding external values into the CLI. The impact is limited by the privileges assigned to the active session. How to fix SQL Injection? Upgrade `snowflake-cli` to version 3.19.0 or higher.	[,3.19.0)
M Insertion of Sensitive Information into Log File snowflake-cli is a Snowflake CLI Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the `debug logging` process. An attacker can access sensitive credentials by obtaining read access to local log files. This is only exploitable if credentials are present in the connection context and the resulting logs are accessible from the local environment. How to fix Insertion of Sensitive Information into Log File? Upgrade `snowflake-cli` to version 3.19.0 or higher.	[,3.19.0)
C Arbitrary Code Injection snowflake-cli is a Snowflake CLI Affected versions of this package are vulnerable to Arbitrary Code Injection in the `Snowpark` annotation processor template. An attacker can execute arbitrary code by supplying crafted project content that is interpolated into generated Python code during application bundling or deployment. This is only exploitable if the victim runs the relevant bundling or deployment workflow against attacker-controlled project content. How to fix Arbitrary Code Injection? Upgrade `snowflake-cli` to version 3.19.0 or higher.	[,3.19.0)
H Directory Traversal snowflake-cli is a Snowflake CLI Affected versions of this package are vulnerable to Directory Traversal via improper restriction of file path resolution. An attacker can access and exfiltrate arbitrary local files by supplying crafted project or repository content that references files outside the intended project boundary. This is only exploitable if a victim processes attacker-controlled project content and the attacker can retrieve exfiltrated data from the victim's Snowflake account artifacts such as query history or uploaded stage content. How to fix Directory Traversal? Upgrade `snowflake-cli` to version 3.19.0 or higher.	[,3.19.0)
M SQL Injection snowflake-cli is a Snowflake CLI Affected versions of this package are vulnerable to SQL Injection via improper neutralization of local CLI parameters in the `Cortex SQL` or object listing command paths. An attacker can execute unintended SQL statements within the context of the current user's Snowflake session by supplying crafted values as local CLI arguments. This is only exploitable if the attacker has access to the local environment and can supply arguments directly to the CLI; exploitation is limited to the privileges of the current session. How to fix SQL Injection? Upgrade `snowflake-cli` to version 3.19.0 or higher.	[,3.19.0)
M SQL Injection snowflake-cli is a Snowflake CLI Affected versions of this package are vulnerable to SQL Injection through the processing of attacker-controlled content in repository data, project configuration, manifest data, or specification input. An attacker can execute unintended SQL statements in the context of a victim user's session by supplying crafted input. This is only exploitable if the victim processes attacker-controlled content through a vulnerable command path and the attack is limited by the privileges of the affected session. How to fix SQL Injection? Upgrade `snowflake-cli` to version 3.19.0 or higher.	[,3.19.0)

Vulnerability

Vulnerable Version

Server-side Request Forgery (SSRF)

snowflake-cli is a Snowflake CLI

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the !source or !load directives, which allow referencing remote URLs that are fetched at runtime without sufficient restriction on the request destination. An attacker can trigger unintended outbound requests from the victim's environment to internal or non-public network locations, and potentially cause remote SQL content to be retrieved and executed in the context of the victim user's session by supplying crafted SQL content processed through a vulnerable command path. This is only exploitable if the victim processes attacker-controlled content through a vulnerable command path.

How to fix Server-side Request Forgery (SSRF)?