Improper neutralization within the Snowpark annotation processor callback template in Snowflake CLI versions before 3.19 permits an attacker to inject crafted content that is interpolated into generated Python code, leading to arbitrary code execution in the local context of the user running the CLI. The vulnerability arises from the lack of safe handling of template variables, allowing the injection of malicious code that the CLI subsequently executes during application bundling or deployment. This flaw can compromise confidentiality, integrity, and availability as the attacker’s code runs with the privileges of the user launching the process.

The vendor Snowflake CLI is affected. All installations of Snowflake CLI with versions prior to 3.19 are vulnerable. The patch is available in version 3.19 and later.

The CVSS score is 8.8, indicating high severity. No EPSS score is currently available, so the probability of exploitation is uncertain. The vulnerability is not listed in CISA KEV. Attacks likely require an attacker to supply crafted project content that is bundled or deployed by a user, implying a local or insider attack scenario rather than a remote network exploit. Successful exploitation would execute arbitrary code with the local user’s privileges.