Vulnerabilities in pkg:pypi/snowflake-sqlalchemy

PACKAGE
Advisory Identifier: GHSA-8g6f-qw9x-4q6q
Share
Advisory Summary

CVE-2026-15736 is a HIGH (CVSS 8.3) sql injection vulnerability (CWE-73: External Control of File Name or Path) affecting Snowflake sqlalchemy libraries in the PyPI ecosystem. The issue involves snowflake sqlalchemy affected by sql injection and local file disclosure vulnerabilities. Remediation is available by upgrading affected packages to version 1.11.0.

1 Known Advisory Record(s)
Package Vulnerability Intelligence

pkg:pypi/snowflake-sqlalchemy

1 Known Advisory Record(s)

Vulnerability advisories affecting package pkg:pypi/snowflake-sqlalchemy. Select an advisory below to view technical details or fixes.

Advisory ID CVE / NVD Severity Summary
GHSA-8g6f-qw9x-4q6q CVE-2026-15736 HIGH Snowflake SQLAlchemy affected by SQL injection and local file disclosure vulnerabilities

CVE-2026-15736 at a Glance

CVE Identifier CVE-2026-15736
GHSA Identifier GHSA-8g6f-qw9x-4q6q
Severity HIGH
CVSS v3.1 Base Score 8.3
CWE Classification CWE-73: External Control of File Name or Path
Affected Product Snowflake sqlalchemy
Package Ecosystem PyPI
Published Date
Last Updated

Security Impact

CVSS: 8.3

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required Low (PR:L)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity High (I:H)
Availability Low (A:L)

How to Fix CVE-2026-15736

To remediate this vulnerability, upgrade all affected Snowflake sqlalchemy dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

snowflake-sqlalchemy fixed: 1.11.0 
pip install snowflake-sqlalchemy>=1.11.0
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

pip show snowflake-sqlalchemy

How to Check if You Are Affected

To determine whether your Python environment is affected by CVE-2026-15736, inspect your installed packages using pip:

pip show snowflake-sqlalchemy

Analyze the terminal output to locate any version of Snowflake sqlalchemy in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.11.0), your application is affected.

Note: The pip show snowflake-sqlalchemy command checks currently installed packages in your active Python environment.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-73: External Control of File Name or Path, where the product allows user input to control or influence paths or file names that are used in filesystem operations. In Snowflake sqlalchemy, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

Snowflake SQLAlchemy versions prior to 1.11.0 contain several security vulnerabilities, including: Improper handling of user-supplied column identifiers in merge operations could allow SQL injection through attacker-controlled input keys. An attacker may be able to exploit this through request field names in a dynamic upsert endpoint, potentially enabling read access to data visible to the application's database role or modification of values within the same MERGE statement. Improper literal rendering of bound parameters when building certain Snowflake-specific table creation queries could allow SQL injection. An attacker may be able to exploit this by supplying a crafted string to any application endpoint that passes user-controlled data through the affected query-building API, potentially causing arbitrary data exfiltration within the scope of the connection role. Improper forwarding of connection configuration parameters could allow an attacker to cause the library to read arbitrary local files and transmit their contents to an attacker-controlled endpoint. An attacker may be able to exploit this in deployment environments that accept user-controlled connection parameters, potentially exposing sensitive files accessible to the application process. The fix is available in Snowflake SQLAlchemy version 1.11.0. Users must manually upgrade.

CVE-2026-15736 Affected Snowflake sqlalchemy Versions

1 component(s)
Fixed Versions:
1.11.0
Product / Package Ecosystem Affected Versions Fixed Version
snowflake-sqlalchemy
pypi/snowflake-sqlalchemy
PyPI
≥ 1.1.6
< 1.11.0
1.11.0

References

NVD — CVE-2026-15736 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-15736
Snowflake sqlalchemy Source Repository REPOSITORY
https://github.com/snowflakedb/snowflake-sqlalchemy/pull/707
Snowflake sqlalchemy Source Repository REPOSITORY
https://github.com/snowflakedb/snowflake-sqlalchemy/pull/708
Snowflake sqlalchemy Source Repository REPOSITORY
https://github.com/snowflakedb/snowflake-sqlalchemy/pull/710
Security Fix Commit FIX COMMIT
https://github.com/snowflakedb/snowflake-sqlalchemy/commit/2c33792c91449e746a2c7ef24c25f0ede0a4a875
Security Fix Commit FIX COMMIT
https://github.com/snowflakedb/snowflake-sqlalchemy/commit/35edf4dc5e76b9a9fdfa74c8e4f6fd14642110f1
Security Fix Commit FIX COMMIT
https://github.com/snowflakedb/snowflake-sqlalchemy/commit/a198ed2197bb3e0be57268032ed6e8b7fdeb8129
Snowflake sqlalchemy Source Repository REPOSITORY
https://github.com/snowflakedb/snowflake-sqlalchemy
Snowflake sqlalchemy Source Repository REPOSITORY
https://github.com/snowflakedb/snowflake-sqlalchemy/releases
Snowflake sqlalchemy Release RELEASE
https://github.com/snowflakedb/snowflake-sqlalchemy/releases/tag/v1.11.0

Frequently Asked Questions

What is CVE-2026-15736?
CVE-2026-15736 is a security vulnerability in Snowflake sqlalchemy involving Snowflake SQLAlchemy affected by SQL injection and local file disclosure vulnerabilities under CWE-73: External Control of File Name or Path.
Which Snowflake sqlalchemy versions are affected?
Affected versions include releases prior to 1.11.0 across affected packages: snowflake-sqlalchemy.
What version fixes CVE-2026-15736?
Upgrading to 1.11.0 (or the latest patched release for your respective branch) resolves the vulnerability.
Is snowflake-sqlalchemy affected?
Yes, snowflake-sqlalchemy is affected in releases prior to 1.11.0. Upgrade your dependency to 1.11.0 or later.
What is the CVSS score of CVE-2026-15736?
CVE-2026-15736 has a CVSS v3.1 base score of 8.3 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L.
What CWE is associated with CVE-2026-15736?
CVE-2026-15736 is classified under CWE-73: External Control of File Name or Path (The product allows user input to control or influence paths or file names that are used in filesystem operations.).
How can I check PyPI dependencies for CVE-2026-15736?
Run the dependency tree command: 'pip show snowflake-sqlalchemy'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-8g6f-qw9x-4q6q",
  "modified" : "2026-09-03T19:49:44Z",
  "published" : "2026-07-14T15:32:17Z",
  "aliases" : [ "CVE-2026-15736" ],
  "summary" : "Snowflake SQLAlchemy affected by SQL injection and local file disclosure vulnerabilities",
  "details" : "Snowflake SQLAlchemy versions prior to 1.11.0 contain several security vulnerabilities, including: Improper handling of user-supplied column identifiers in merge operations could allow SQL injection through attacker-controlled input keys. An attacker may be able to exploit this through request field names in a dynamic upsert endpoint, potentially enabling read access to data visible to the application's database role or modification of values within the same MERGE statement. Improper literal rendering of bound parameters when building certain Snowflake-specific table creation queries could allow SQL injection. An attacker may be able to exploit this by supplying a crafted string to any application endpoint that passes user-controlled data through the affected query-building API, potentially causing arbitrary data exfiltration within the scope of the connection role. Improper forwarding of connection configuration parameters could allow an attacker to cause the library to read arbitrary local files and transmit their contents to an attacker-controlled endpoint. An attacker may be able to exploit this in deployment environments that accept user-controlled connection parameters, potentially exposing sensitive files accessible to the application process. The fix is available in Snowflake SQLAlchemy version 1.11.0. Users must manually upgrade.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "snowflake-sqlalchemy"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.1.6"
      }, {
        "fixed" : "1.11.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-15736"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/snowflakedb/snowflake-sqlalchemy/pull/707"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/snowflakedb/snowflake-sqlalchemy/pull/708"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/snowflakedb/snowflake-sqlalchemy/pull/710"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/snowflakedb/snowflake-sqlalchemy/commit/2c33792c91449e746a2c7ef24c25f0ede0a4a875"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/snowflakedb/snowflake-sqlalchemy/commit/35edf4dc5e76b9a9fdfa74c8e4f6fd14642110f1"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/snowflakedb/snowflake-sqlalchemy/commit/a198ed2197bb3e0be57268032ed6e8b7fdeb8129"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/snowflakedb/snowflake-sqlalchemy"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/snowflakedb/snowflake-sqlalchemy/releases"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/snowflakedb/snowflake-sqlalchemy/releases/tag/v1.11.0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-73" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-09-03T19:49:44Z",
    "nvd_published_at" : "2026-07-14T15:17:01Z"
  }
}