Paper/Archive/CVE-2025-50213

CVE-2025-50213

Apache Software Foundation Apache Airflow Providers Snowflake — Apache Airflow Providers Snowflake: Potential SQL injection in CopyFromExternalStageToSnowflakeOperator

EPSS 0.8%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (ADP)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 55.8.558 × 2011.2 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) vulnerability in Apache Airflow Providers Snowflake. This issue affects Apache Airflow Providers Snowflake: before 6.4.0. Sanitation of table and stage parameters were added in CopyFromExternalStageToSnowflakeOperator to prevent SQL injection Users are recommended to upgrade to version 6.4.0, which fixes the issue.

Affected

ProductAffectedFixed inSource

Apache Airflow Providers Snowflake< 6.4.06.4.0CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

patchgithub.com/apache/airflow/pull/51734 advisorylists.apache.org/thread/2kqfmyt2pghg5f6797g8hzvq331v8qx3