This vulnerability in Snowflake CLI (CVE-2026-13749) involves improper control of code generation in the Snowpark annotation processor callback template. Specifically, crafted project content can be injected into generated Python code during bundling or deployment, leading to arbitrary code execution in the local user's context. The attack vector requires the victim to run the affected bundling or deployment workflow with attacker-controlled input. The vulnerability affects Snowflake CLI version 2.4.0 and is fixed in version 3.19. The CVSS 3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to execute arbitrary code locally with the privileges of the user running the Snowflake CLI. This can lead to full compromise of the local environment, including unauthorized access, data manipulation, and disruption of availability. The vulnerability requires user interaction and running a specific workflow with malicious project content, limiting remote exploitation but still posing a significant risk.

A patch is available in Snowflake CLI version 3.19. Users must manually upgrade to this version or later to remediate the vulnerability. Since this is a client-side tool, the vendor does not manage remediation automatically. Until upgraded, users should avoid running bundling or deployment workflows against untrusted or attacker-controlled project content.