CVE-2025-50213

Critical

Description

Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) vulnerability in Apache Airflow Providers Snowflake. This issue affects Apache Airflow Providers Snowflake: before 6.4.0. Sanitation of table and stage parameters were added in CopyFromExternalStageToSnowflakeOperator to prevent SQL injection Users are recommended to upgrade to version 6.4.0, which fixes the issue.

SeverityCritical

CVSS9.8

Exploit probability—

Product

Apache-airflow-providers-snowflake

PublishedJun 24, 2025

First seenJun 24, 2025

Weakness typeCWE-75CWE-75

How to fix

Update

apache apache-airflow-providers-snowflake6.4.0 or later
apache-airflow-providers-snowflake6.4.0 or later

Patches

github.com/apache/airflow/pull/51734

Vendor advisories

lists.apache.org/thread/2kqfmyt2pghg5f6797g8hzvq331v8qx3

Affected products

Product	Affected versions	Fixed in
apache apache-airflow-providers-snowflake	v < 6.4.0	6.4.0
apache-airflow-providers-snowflakePyPI	v < 6.4.0	6.4.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.