GitHub Advisoryadvisory · PyPI

GHSA-9r64-3wmc-x8m8 Apache Airflow Providers Snowflake package allows for Special Element Injection via CopyFromExternalStageToSnowflakeOperator

CRITICAL Published 2025-06-26 Modified 2025-06-27 Official page ↗
Aliases
CVE-2025-50213
Ecosystem
PyPI
Packages
apache-airflow-providers-snowflake
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-75
Reviewed
2025-06-27

Affected packages

• PyPI apache-airflow-providers-snowflake: < 6.4.0 → fixed in 6.4.0

Description

Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) vulnerability in Apache Airflow Providers Snowflake. This issue affects Apache Airflow Providers Snowflake: before 6.4.0. Sanitation of table and stage parameters were added in CopyFromExternalStageToSnowflakeOperator to prevent SQL injection Users are recommended to upgrade to version 6.4.0, which fixes the issue.

Related

Alias · CVE (1)

  • CVE-2025-50213 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) vulnerability in Apache Airflow Providers Snowflake. vulnerability

Weakness · CWE (1)

  • CWE-75 Failure to Sanitize Special Elements into a Different Plane weakness

References