CVE-2025-50213

Apache Airflow Providers Snowflake: Potential SQL injection in CopyFromExternalStageToSnowflakeOperator

State: Published
Severity: 9.8 Critical
Published: Jun 24, 2025
Updated: Jun 24, 2025
Reserved: Jun 14, 2025

Description

Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) vulnerability in Apache Airflow Providers Snowflake.

This issue affects Apache Airflow Providers Snowflake: before 6.4.0.

Sanitation of table and stage parameters were added in CopyFromExternalStageToSnowflakeOperator to prevent SQL injection Users are recommended to upgrade to version 6.4.0, which fixes the issue.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-75 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)

Affected Products

Product	Versions
Apache Airflow Providers SnowflakeApache Software Foundation	before 6.4.0Affected

References

https://github.com/apache/airflow/pull/51734patch
https://lists.apache.org/thread/2kqfmyt2pghg5f6797g8hzvq331v8qx3vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.