Critical severity · published Jun 24, 2025
CVE-2025-50213
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) vulnerability in Apache Airflow Providers Snowflake
9.8
CVSS
0.8%
EPSS
No
On KEV
Description
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) vulnerability in Apache Airflow Providers Snowflake.
This issue affects Apache Airflow Providers Snowflake: before 6.4.0.
Sanitation of table and stage parameters were added in CopyFromExternalStageToSnowflakeOperator to prevent SQL injection
Users are recommended to upgrade to version 6.4.0, which fixes the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AP
Apache-airflow-providers-snowflake · Apache
before 6.4.0 · source: NVD
Affected product
AP
Apache-airflow-providers-snowflake
Apache
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-50213
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-50213
Issue Tracking
https://github.com/apache/airflow/pull/51734
Mailing List
https://lists.apache.org/thread/2kqfmyt2pghg5f6797g8hzvq331v8qx3
More from Apache-airflow-providers-snowflake
6.3
CVE-2026-81930
Apache Airflow Snowflake provider: Unvalidated account field redirects SQL API bearer token off-domain