GHSA-9r64-3wmc-x8m8CriticalCVSS 9.8

Apache Airflow Providers Snowflake package allows for Special Element Injection via CopyFromExternalStageToSnowflakeOperator

Published
June 26, 2025
Last Modified
June 27, 2025

🔗 CVE IDs covered (1)

CVE-2025-50213 →

📋 Description

Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) vulnerability in Apache Airflow Providers Snowflake.

This issue affects Apache Airflow Providers Snowflake: before 6.4.0.

Sanitation of table and stage parameters were added in CopyFromExternalStageToSnowflakeOperator to prevent SQL injection Users are recommended to upgrade to version 6.4.0, which fixes the issue.

🎯 Affected products1

  • pip/apache-airflow-providers-snowflake:< 6.4.0

🔗 References (6)