CVE-2025-50213

CRITICAL

9.8

Description

Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) vulnerability in Apache Airflow Providers Snowflake. This issue affects Apache Airflow Providers Snowflake: before 6.4.0. Sanitation of table and stage parameters were added in CopyFromExternalStageToSnowflakeOperator to prevent SQL injection Users are recommended to upgrade to version 6.4.0, which fixes the issue.

CVE Details

CVSS v3.1 Score9.8

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published6/24/2025

Last Modified7/11/2025

Sourcenvd

Honeypot Sightings0

Affected Products

apache:apache-airflow-providers-snowflake

Weaknesses (CWE)

CWE-75

References

https://github.com/apache/airflow/pull/51734(security@apache.org)

https://lists.apache.org/thread/2kqfmyt2pghg5f6797g8hzvq331v8qx3(security@apache.org)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.