CVE-2025-50213
Apache Airflow Providers Snowflake: Potential SQL injection in CopyFromExternalStageToSnowflakeOperator
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) vulnerability in Apache Airflow Providers Snowflake.
This issue affects Apache Airflow Providers Snowflake: before 6.4.0.
Sanitation of table and stage parameters were added in CopyFromExternalStageToSnowflakeOperator to prevent SQL injection Users are recommended to upgrade to version 6.4.0, which fixes the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Apache Airflow Providers Snowflake: Potential SQL injection in CopyFromExternalStageToSnowflakeOperator
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) vulnerability in Apache Airflow Providers Snowflake.
This issue affects Apache Airflow Providers Snowflake: before 6.4.0.
Sanitation of table and stage parameters were added in CopyFromExternalStageToSnowflakeOperator to prevent SQL injection Users are recommended to upgrade to version 6.4.0, which fixes the issue.
- Record
CVE-2025-50213- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-75
- Updated
- 2026-11-02
EUVDEUVD-2025-19239
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) vulnerability in Apache Airflow Providers Snowflake.
This issue affects Apache Airflow Providers Snowflake: before 6.4.0.
Sanitation of table and stage parameters were added in CopyFromExternalStageToSnowflakeOperator to prevent SQL injection Users are recommended to upgrade to version 6.4.0, which fixes the issue.
- Record
EUVD-2025-19239- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-9r64-3wmc-x8m8
Apache Airflow Providers Snowflake package allows for Special Element Injection via CopyFromExternalStageToSnowflakeOperator
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) vulnerability in Apache Airflow Providers Snowflake.
This issue affects Apache Airflow Providers Snowflake: before 6.4.0.
Sanitation of table and stage parameters were added in CopyFromExternalStageToSnowflakeOperator to prevent SQL injection Users are recommended to upgrade to version 6.4.0, which fixes the issue.
- Record
GHSA-9r64-3wmc-x8m8- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-75
- Updated
- 2026-11-02
NVD
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) vulnerability in Apache Airflow Providers Snowflake.
This issue affects Apache Airflow Providers Snowflake: before 6.4.0.
Sanitation of table and stage parameters were added in CopyFromExternalStageToSnowflakeOperator to prevent SQL injection Users are recommended to upgrade to version 6.4.0, which fixes the issue.
- Record
CVE-2025-50213- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-75
- Updated
- 2026-11-02
OSV
Apache Airflow Providers Snowflake: Potential SQL injection in CopyFromExternalStageToSnowflakeOperator
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) vulnerability in Apache Airflow Providers Snowflake.
This issue affects Apache Airflow Providers Snowflake: before 6.4.0.
Sanitation of table and stage parameters were added in CopyFromExternalStageToSnowflakeOperator to prevent SQL injection Users are recommended to upgrade to version 6.4.0, which fixes the issue.
- Record
CVE-2025-50213- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-75
- Updated
- 2026-11-02
OSVGHSA-9r64-3wmc-x8m8
Apache Airflow Providers Snowflake package allows for Special Element Injection via CopyFromExternalStageToSnowflakeOperator
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) vulnerability in Apache Airflow Providers Snowflake.
This issue affects Apache Airflow Providers Snowflake: before 6.4.0.
Sanitation of table and stage parameters were added in CopyFromExternalStageToSnowflakeOperator to prevent SQL injection Users are recommended to upgrade to version 6.4.0, which fixes the issue.
- Record
GHSA-9r64-3wmc-x8m8- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-75
- Updated
- 2026-11-02
OSVPYSEC-2025-51 No score
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) vulnerability in Apache Airflow Providers Snowflake.
This issue affects Apache Airflow Providers Snowflake: before 6.4.0.
Sanitation of table and stage parameters were added in CopyFromExternalStageToSnowflakeOperator to prevent SQL injection Users are recommended to upgrade to version 6.4.0, which fixes the issue.
- Record
PYSEC-2025-51- Updated
- 2026-11-02
OSVROOT-APP-PYPI-CVE-2025-50213 No score
CVE-2025-50213 in rootio-apache-airflow-providers-snowflake - Patched by Root
Root has patched CVE-2025-50213 in the rootio-apache-airflow-providers-snowflake package for Root:PyPI. Multiple fixed versions available.
- Record
ROOT-APP-PYPI-CVE-2025-50213- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
apache-airflow-providers-snowflakePyPI |
before 6.4.0 | 6.4.0 |
apache-airflow-providers-snowflakePyPI |
before 6.4.0, plus listed versions 1.0.01.0.0b11.0.0b21.0.0rc11.1.0 Show 45 moreShow less1.1.0rc11.1.11.1.1rc11.1.1rc21.2.01.2.0rc11.3.01.3.0rc12.0.02.0.0rc12.0.0rc22.0.0rc32.1.02.1.0rc12.1.0rc22.1.12.1.1rc12.2.02.2.0rc12.3.02.3.0rc12.3.12.3.1rc12.4.02.4.0rc12.5.02.5.0rc12.5.0rc22.5.12.5.1rc12.5.22.5.2rc12.6.02.6.0rc12.7.02.7.0rc13.0.03.0.0rc13.0.0rc23.1.03.1.0rc13.2.03.2.0rc13.2.0rc23.2.0rc3 |
6.4.0 |
rootio-apache-airflow-providers-snowflakeRoot:PyPI |
before 6.3.1+root.io.1 | 6.3.1+root.io.15.8.0+root.io.15.8.0+root.io.26.3.1+root.io.2 |
apache-airflow-providers-snowflakeRoot:PyPI |
before 5.8.0+aikido.2 | 5.8.0+aikido.26.3.1+aikido.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-50213 is a critical vulnerability (CVSS 9.8) in Apache Software Foundation Airflow Providers Snowflake, published June 24, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.77%, the 55th percentile. Fixed in apache-airflow-providers-snowflake 6.4.0.
References
github.com/apache/airflow/pull/51734
lists.apache.org/thread/2kqfmyt2pghg5f6797g8hzvq331v8qx3
nvd.nist.gov/vuln/detail/CVE-2025-50213
pypi.python.org
Left out here: 88 versions. The JSON record has them.