The vulnerability in Snowflake CLI allows attackers to supply crafted repository or project content that references files outside the intended project directory. This improper file path resolution permits the CLI to read arbitrary local files and transmit their contents to Snowflake services during deployment or SQL template processing. The result is a local file read that can lead to data exfiltration, compromising the confidentiality of files on the victim’s system.

Snowflake CLI versions prior to 3.19 are affected. The vulnerability applies to the Snowflake CLI tool used for deploying projects, uploading stages, and processing SQL templates. Any installation of Snowflake CLI that has not been upgraded to 3.19 or later is vulnerable.

The CVSS score of 6.3 classifies the flaw as medium severity. EPSS is not available, but the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the victim to run the CLI with attacker‑controlled project content; therefore the attack vector is local or requires social engineering to supply the content. Once the CLI executes the content, it will read the specified files and upload their contents to the Snowflake account, making detection reliant on account monitoring. Because the flaw exploits path‑traversal weaknesses (CWE‑22, CWE‑61, CWE‑73), any user who processes untrusted project data is at risk.