CVE-2025-24793
Snowflake Connector for Python has an SQL Injection in write_pandas
The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. A function from the snowflake.connector.pandas_tools module is vulnerable to SQL injection. This vulnerability affects versions 2.2.5 through 3.13.0. Snowflake fixed the issue in version 3.13.1.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Snowflake Connector for Python has an SQL Injection in write_pandas
The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. A function from the snowflake.connector.pandas_tools module is vulnerable to SQL injection. This vulnerability affects versions 2.2.5 through 3.13.0. Snowflake fixed the issue in version 3.13.1.
- Record
CVE-2025-24793- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
EUVDEUVD-2025-0122
The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. A function from the snowflake.connector.pandas_tools module is vulnerable to SQL injection. This vulnerability affects versions 2.2.5 through 3.13.0. Snowflake fixed the issue in version 3.13.1.
- Record
EUVD-2025-0122- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2vpq-fh52-j3wv
snowflake-connector-python vulnerable to SQL Injection in write_pandas
Issue
Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. A function from the snowflake.connector.pandas_tools module is vulnerable to SQL injection.
This vulnerability affects versions 2.2.5 through 3.13.0. Snowflake fixed the issue in version 3.13.1.
Vulnerability Details
A function from the snowflake.connector.pandas_tools module is not sanitizing all of its arguments, and queries using them are not parametrized. An attacker controlling these arguments could achieve SQL injection by passing crafted input. Any SQL executed that way by an attacker would still run in the context of the current session.
Solution
Snowflake released version 3.13.1 of the Snowflake Connector for Python, which fixes this issue. We recommend users upgrade to version 3.13.1.
Additional Information
If you discover a security vulnerability in one of our products or websites, please report the issue to HackerOne. For more information, please see our Vulnerability Disclosure Policy.
- Record
GHSA-2vpq-fh52-j3wv- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
NVD
The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. A function from the snowflake.connector.pandas_tools module is vulnerable to SQL injection. This vulnerability affects versions 2.2.5 through 3.13.0. Snowflake fixed the issue in version 3.13.1.
- Record
CVE-2025-24793- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
OSV
Snowflake Connector for Python has an SQL Injection in write_pandas
The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. A function from the snowflake.connector.pandas_tools module is vulnerable to SQL injection. This vulnerability affects versions 2.2.5 through 3.13.0. Snowflake fixed the issue in version 3.13.1.
- Record
CVE-2025-24793- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
OSVGHSA-2vpq-fh52-j3wv
snowflake-connector-python vulnerable to SQL Injection in write_pandas
Issue
Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. A function from the snowflake.connector.pandas_tools module is vulnerable to SQL injection.
This vulnerability affects versions 2.2.5 through 3.13.0. Snowflake fixed the issue in version 3.13.1.
Vulnerability Details
A function from the snowflake.connector.pandas_tools module is not sanitizing all of its arguments, and queries using them are not parametrized. An attacker controlling these arguments could achieve SQL injection by passing crafted input. Any SQL executed that way by an attacker would still run in the context of the current session.
Solution
Snowflake released version 3.13.1 of the Snowflake Connector for Python, which fixes this issue. We recommend users upgrade to version 3.13.1.
Additional Information
If you discover a security vulnerability in one of our products or websites, please report the issue to HackerOne. For more information, please see our Vulnerability Disclosure Policy.
- Record
GHSA-2vpq-fh52-j3wv- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
OSVPYSEC-2025-26 No score
The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. A function from the snowflake.connector.pandas_tools module is vulnerable to SQL injection. This vulnerability affects versions 2.2.5 through 3.13.0. Snowflake fixed the issue in version 3.13.1.
- Record
PYSEC-2025-26- Updated
- 2026-11-02
OSVROOT-APP-PYPI-CVE-2025-24793 No score
CVE-2025-24793 in snowflake-connector-python - Patched by Root
Root has patched CVE-2025-24793 in the snowflake-connector-python package for Root:PyPI. Multiple fixed versions available.
- Record
ROOT-APP-PYPI-CVE-2025-24793- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
snowflake-connector-pythonPyPI |
2.2.5 to 3.13.0 | 3.13.1 |
snowflake-connector-pythonPyPI |
2.2.5 up to 3.13.1, plus listed versions 2.2.102.2.62.2.72.2.82.2.9 Show 45 moreShow less2.3.02.3.12.3.102.3.22.3.32.3.42.3.52.3.62.3.72.3.82.3.92.4.02.4.12.4.22.4.32.4.42.4.52.4.62.5.02.5.12.6.02.6.12.6.22.7.02.7.12.7.102.7.112.7.122.7.22.7.32.7.42.7.52.7.62.7.72.7.82.7.92.8.02.8.12.8.22.8.32.9.03.0.03.0.13.0.23.0.3 |
3.13.1 |
snowflake-connector-pythonRoot:PyPI |
before 3.12.3+aikido.4 | 3.12.3+aikido.43.12.3+aikido.53.12.3+aikido.6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-24793 is a high vulnerability (CVSS 7.0) in Snowflake Connector, published January 29, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 23rd percentile. Fixed in snowflake-connector-python 3.13.1.
References
github.com/snowflakedb/snowflake-connector-python/security/advisories/GHSA-2vpq-fh52-j3wv
nvd.nist.gov/vuln/detail/CVE-2025-24793
Left out here: 29 versions. The JSON record has them.