CVE-2025-50213 Apache Airflow Providers Snowflake: Potential SQL injection in CopyFromExternalStageToSnowflakeOperator
Attackers can execute arbitrary SQL commands via unsanitized parameters in the Snowflake operator, requiring an upgrade to the provider library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-50213?
CVE-2025-50213 is a critical SQL injection vulnerability in Apache Airflow Providers Snowflake, published on 24 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) vulnerability in Apache Airflow Providers Snowflake.
This issue affects Apache Airflow Providers Snowflake: before 6.4.0.
Sanitation of table and stage parameters were added in CopyFromExternalStageToSnowflakeOperator to prevent SQL injection Users are recommended to upgrade to version 6.4.0, which fixes the issue.
Weakness: CWE-75
Which versions are affected by CVE-2025-50213?
3 open source packages ship an affected version, including apache-airflow-providers-snowflake. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
apache-airflow-providers-snowflake PyPI | All versions | 6.4.0 |
apache-airflow-providers-snowflake PyPI | All versions | 6.4.0 |
apache-airflow-providers-snowflake PyPI | All versions | 6.4.0 |
Products include Apache Apache-Airflow-Providers-Snowflake.
How do I fix CVE-2025-50213?
Upgrade apache-airflow-providers-snowflake to 6.4.0 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2025-50213 being exploited?
There is no known exploitation of CVE-2025-50213 in the wild and no public exploit code.
Other vulnerabilities in Apache Airflow Providers Snowflake
Sources
Also known as ECHO-b963-92f2-cbc3, GHSA-9r64-3wmc-x8m8, PYSEC-2025-51, ROOT-APP-PYPI-CVE-2025-50213.