cvelistv5 - cve-2025-50213

CVE-2025-50213 (GCVE-0-2025-50213)

Vulnerability from cvelistv5

Published

2025-06-24 07:06

Modified

2025-06-24 18:03

Severity ?

CWE

CWE-75 - Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)

Summary

Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) vulnerability in Apache Airflow Providers Snowflake. This issue affects Apache Airflow Providers Snowflake: before 6.4.0. Sanitation of table and stage parameters were added in CopyFromExternalStageToSnowflakeOperator to prevent SQL injection Users are recommended to upgrade to version 6.4.0, which fixes the issue.

References

►

URL

Tags

	security@apache.org	https://github.com/apache/airflow/pull/51734	Issue Tracking, Patch
	security@apache.org	https://lists.apache.org/thread/2kqfmyt2pghg5f6797g8hzvq331v8qx3	Mailing List, Vendor Advisory

Impacted products

	Vendor	Product	Version
	Apache Software Foundation	Apache Airflow Providers Snowflake	Version: 0 ≤

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-50213",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-24T13:46:28.362554Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-24T18:03:35.296Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pypi.python.org",
          "defaultStatus": "unaffected",
          "packageName": "apache-airflow-providers-snowflake",
          "product": "Apache Airflow Providers Snowflake",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "6.4.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nhien Pham (@nhienit) at Galaxy One"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eFailure to Sanitize Special Elements into a Different Plane (Special Element Injection) vulnerability in Apache Airflow Providers Snowflake.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Airflow Providers Snowflake: before 6.4.0.\u003c/p\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eSanitation of table and stage parameters were added in\u003c/span\u003e\u0026nbsp;CopyFromExternalStageToSnowflakeOperator\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eto prevent\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;SQL injection\u003c/span\u003e\u003c/span\u003e\u003cbr\u003e\u003cp\u003eUsers are recommended to upgrade to version 6.4.0, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) vulnerability in Apache Airflow Providers Snowflake.\n\nThis issue affects Apache Airflow Providers Snowflake: before 6.4.0.\n\nSanitation of table and stage parameters were added in\u00a0CopyFromExternalStageToSnowflakeOperator\u00a0to prevent\u00a0SQL injection\nUsers are recommended to upgrade to version 6.4.0, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "low"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-75",
              "description": "CWE-75 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-06-24T07:06:53.128Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/apache/airflow/pull/51734"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/2kqfmyt2pghg5f6797g8hzvq331v8qx3"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache Airflow Providers Snowflake: Potential SQL injection in CopyFromExternalStageToSnowflakeOperator",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2025-50213",
    "datePublished": "2025-06-24T07:06:53.128Z",
    "dateReserved": "2025-06-14T15:37:44.797Z",
    "dateUpdated": "2025-06-24T18:03:35.296Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-50213\",\"sourceIdentifier\":\"security@apache.org\",\"published\":\"2025-06-24T08:15:24.253\",\"lastModified\":\"2025-07-11T18:36:05.753\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) vulnerability in Apache Airflow Providers Snowflake.\\n\\nThis issue affects Apache Airflow Providers Snowflake: before 6.4.0.\\n\\nSanitation of table and stage parameters were added in\u00a0CopyFromExternalStageToSnowflakeOperator\u00a0to prevent\u00a0SQL injection\\nUsers are recommended to upgrade to version 6.4.0, which fixes the issue.\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad por fallo en la depuraci\u00f3n de elementos especiales en un plano diferente (inyecci\u00f3n de elementos especiales) en Apache Airflow Providers Snowflake. Este problema afecta a Apache Airflow Providers Snowflake: versiones anteriores a la 6.4.0. Se a\u00f1adi\u00f3 la depuraci\u00f3n de los par\u00e1metros de tabla y etapa en CopyFromExternalStageToSnowflakeOperator para evitar la inyecci\u00f3n de SQL. Se recomienda a los usuarios actualizar a la versi\u00f3n 6.4.0, que soluciona el problema.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"security@apache.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-75\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:apache-airflow-providers-snowflake:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.4.0\",\"matchCriteriaId\":\"FB551B24-0E93-4F5F-B201-B96E875D49B4\"}]}]}],\"references\":[{\"url\":\"https://github.com/apache/airflow/pull/51734\",\"source\":\"security@apache.org\",\"tags\":[\"Issue Tracking\",\"Patch\"]},{\"url\":\"https://lists.apache.org/thread/2kqfmyt2pghg5f6797g8hzvq331v8qx3\",\"source\":\"security@apache.org\",\"tags\":[\"Mailing List\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-50213\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-06-24T13:46:28.362554Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-06-24T13:46:30.536Z\"}}], \"cna\": {\"title\": \"Apache Airflow Providers Snowflake: Potential SQL injection in CopyFromExternalStageToSnowflakeOperator\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Nhien Pham (@nhienit) at Galaxy One\"}], \"metrics\": [{\"other\": {\"type\": \"Textual description of severity\", \"content\": {\"text\": \"low\"}}}], \"affected\": [{\"vendor\": \"Apache Software Foundation\", \"product\": \"Apache Airflow Providers Snowflake\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"6.4.0\", \"versionType\": \"semver\"}], \"packageName\": \"apache-airflow-providers-snowflake\", \"collectionURL\": \"https://pypi.python.org\", \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://github.com/apache/airflow/pull/51734\", \"tags\": [\"patch\"]}, {\"url\": \"https://lists.apache.org/thread/2kqfmyt2pghg5f6797g8hzvq331v8qx3\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) vulnerability in Apache Airflow Providers Snowflake.\\n\\nThis issue affects Apache Airflow Providers Snowflake: before 6.4.0.\\n\\nSanitation of table and stage parameters were added in\\u00a0CopyFromExternalStageToSnowflakeOperator\\u00a0to prevent\\u00a0SQL injection\\nUsers are recommended to upgrade to version 6.4.0, which fixes the issue.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eFailure to Sanitize Special Elements into a Different Plane (Special Element Injection) vulnerability in Apache Airflow Providers Snowflake.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Airflow Providers Snowflake: before 6.4.0.\u003c/p\u003e\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003e\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eSanitation of table and stage parameters were added in\u003c/span\u003e\u0026nbsp;CopyFromExternalStageToSnowflakeOperator\u0026nbsp;\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eto prevent\u003c/span\u003e\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003e\u0026nbsp;SQL injection\u003c/span\u003e\u003c/span\u003e\u003cbr\u003e\u003cp\u003eUsers are recommended to upgrade to version 6.4.0, which fixes the issue.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-75\", \"description\": \"CWE-75 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)\"}]}], \"providerMetadata\": {\"orgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"shortName\": \"apache\", \"dateUpdated\": \"2025-06-24T07:06:53.128Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-50213\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-06-24T18:03:35.296Z\", \"dateReserved\": \"2025-06-14T15:37:44.797Z\", \"assignerOrgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"datePublished\": \"2025-06-24T07:06:53.128Z\", \"assignerShortName\": \"apache\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

fkie_cve-2025-50213

Vulnerability from fkie_nvd

Published

2025-06-24 08:15

Modified

2025-07-11 18:36

Severity ?

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

▶	URL	Tags
	security@apache.org	https://github.com/apache/airflow/pull/51734	Issue Tracking, Patch
	security@apache.org	https://lists.apache.org/thread/2kqfmyt2pghg5f6797g8hzvq331v8qx3	Mailing List, Vendor Advisory

Impacted products

	Vendor	Product	Version
	apache	apache-airflow-providers-snowflake	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:apache-airflow-providers-snowflake:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "FB551B24-0E93-4F5F-B201-B96E875D49B4",
              "versionEndExcluding": "6.4.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) vulnerability in Apache Airflow Providers Snowflake.\n\nThis issue affects Apache Airflow Providers Snowflake: before 6.4.0.\n\nSanitation of table and stage parameters were added in\u00a0CopyFromExternalStageToSnowflakeOperator\u00a0to prevent\u00a0SQL injection\nUsers are recommended to upgrade to version 6.4.0, which fixes the issue."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad por fallo en la depuraci\u00f3n de elementos especiales en un plano diferente (inyecci\u00f3n de elementos especiales) en Apache Airflow Providers Snowflake. Este problema afecta a Apache Airflow Providers Snowflake: versiones anteriores a la 6.4.0. Se a\u00f1adi\u00f3 la depuraci\u00f3n de los par\u00e1metros de tabla y etapa en CopyFromExternalStageToSnowflakeOperator para evitar la inyecci\u00f3n de SQL. Se recomienda a los usuarios actualizar a la versi\u00f3n 6.4.0, que soluciona el problema."
    }
  ],
  "id": "CVE-2025-50213",
  "lastModified": "2025-07-11T18:36:05.753",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-06-24T08:15:24.253",
  "references": [
    {
      "source": "security@apache.org",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "url": "https://github.com/apache/airflow/pull/51734"
    },
    {
      "source": "security@apache.org",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "url": "https://lists.apache.org/thread/2kqfmyt2pghg5f6797g8hzvq331v8qx3"
    }
  ],
  "sourceIdentifier": "security@apache.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-75"
        }
      ],
      "source": "security@apache.org",
      "type": "Secondary"
    }
  ]
}

ghsa-9r64-3wmc-x8m8

Vulnerability from github

Published

2025-06-26 21:31

Modified

2025-06-27 21:15

Severity ?

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

Apache Airflow Providers Snowflake package allows for Special Element Injection via CopyFromExternalStageToSnowflakeOperator

Details

Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) vulnerability in Apache Airflow Providers Snowflake.

This issue affects Apache Airflow Providers Snowflake: before 6.4.0.

Sanitation of table and stage parameters were added in CopyFromExternalStageToSnowflakeOperator to prevent SQL injection Users are recommended to upgrade to version 6.4.0, which fixes the issue.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "apache-airflow-providers-snowflake"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.4.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-50213"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-75"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-06-27T21:15:56Z",
    "nvd_published_at": "2025-06-24T08:15:24Z",
    "severity": "CRITICAL"
  },
  "details": "Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) vulnerability in Apache Airflow Providers Snowflake.\n\nThis issue affects Apache Airflow Providers Snowflake: before 6.4.0.\n\nSanitation of table and stage parameters were added in\u00a0CopyFromExternalStageToSnowflakeOperator\u00a0to prevent\u00a0SQL injection\nUsers are recommended to upgrade to version 6.4.0, which fixes the issue.",
  "id": "GHSA-9r64-3wmc-x8m8",
  "modified": "2025-06-27T21:15:56Z",
  "published": "2025-06-26T21:31:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-50213"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/airflow/pull/51734"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/airflow/pull/51734/commits/bcf19916738e4a7065a3911814ba1fa32d6fd669"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/airflow"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow-providers-snowflake/PYSEC-2025-51.yaml"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/2kqfmyt2pghg5f6797g8hzvq331v8qx3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Apache Airflow Providers Snowflake package allows for Special Element Injection via CopyFromExternalStageToSnowflakeOperator"
}

pysec-2025-51

Vulnerability from pysec

Published

2025-06-24 08:15

Modified

2025-06-26 21:23

Details

Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) vulnerability in Apache Airflow Providers Snowflake.

This issue affects Apache Airflow Providers Snowflake: before 6.4.0.

Sanitation of table and stage parameters were added in CopyFromExternalStageToSnowflakeOperator to prevent SQL injection Users are recommended to upgrade to version 6.4.0, which fixes the issue.

Impacted products

Name	purl
apache-airflow-providers-snowflake	pkg:pypi/apache-airflow-providers-snowflake

Aliases

CVE-2025-50213

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "apache-airflow-providers-snowflake",
        "purl": "pkg:pypi/apache-airflow-providers-snowflake"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.4.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0.0",
        "1.0.0b1",
        "1.0.0b2",
        "1.0.0rc1",
        "1.1.0",
        "1.1.0rc1",
        "1.1.1",
        "1.1.1rc1",
        "1.1.1rc2",
        "1.2.0",
        "1.2.0rc1",
        "1.3.0",
        "1.3.0rc1",
        "2.0.0",
        "2.0.0rc1",
        "2.0.0rc2",
        "2.0.0rc3",
        "2.1.0",
        "2.1.0rc1",
        "2.1.0rc2",
        "2.1.1",
        "2.1.1rc1",
        "2.2.0",
        "2.2.0rc1",
        "2.3.0",
        "2.3.0rc1",
        "2.3.1",
        "2.3.1rc1",
        "2.4.0",
        "2.4.0rc1",
        "2.5.0",
        "2.5.0rc1",
        "2.5.0rc2",
        "2.5.1",
        "2.5.1rc1",
        "2.5.2",
        "2.5.2rc1",
        "2.6.0",
        "2.6.0rc1",
        "2.7.0",
        "2.7.0rc1",
        "3.0.0",
        "3.0.0rc1",
        "3.0.0rc2",
        "3.1.0",
        "3.1.0rc1",
        "3.2.0",
        "3.2.0rc1",
        "3.2.0rc2",
        "3.2.0rc3",
        "3.3.0",
        "3.3.0rc1",
        "4.0.0",
        "4.0.0rc1",
        "4.0.1",
        "4.0.1rc2",
        "4.0.1rc3",
        "4.0.2",
        "4.0.2rc1",
        "4.0.3",
        "4.0.3rc1",
        "4.0.4",
        "4.0.4rc1",
        "4.0.5",
        "4.0.5rc1",
        "4.1.0",
        "4.1.0rc1",
        "4.1.0rc2",
        "4.2.0",
        "4.2.0rc1",
        "4.3.0",
        "4.3.0rc2",
        "4.3.1",
        "4.3.1rc1",
        "4.4.0",
        "4.4.0rc1",
        "4.4.1",
        "4.4.1rc1",
        "4.4.2",
        "4.4.2rc1",
        "5.0.0",
        "5.0.0rc1",
        "5.0.1",
        "5.0.1rc1",
        "5.1.0",
        "5.1.0rc1",
        "5.1.1",
        "5.1.1rc1",
        "5.1.2",
        "5.1.2rc1",
        "5.2.0",
        "5.2.0rc1",
        "5.2.1",
        "5.2.1rc1",
        "5.3.0",
        "5.3.0rc1",
        "5.3.0rc2",
        "5.3.1",
        "5.3.1rc1",
        "5.4.0",
        "5.4.0rc1",
        "5.5.0",
        "5.5.0rc1",
        "5.5.1",
        "5.5.1rc1",
        "5.5.2",
        "5.5.2rc1",
        "5.6.0",
        "5.6.0rc1",
        "5.6.1",
        "5.6.1rc1",
        "5.7.0",
        "5.7.0rc1",
        "5.7.1",
        "5.7.1rc1",
        "5.8.0",
        "5.8.0rc1",
        "5.8.1",
        "5.8.1rc1",
        "6.0.0",
        "6.0.0rc1",
        "6.0.0rc2",
        "6.1.0",
        "6.1.0rc1",
        "6.1.1",
        "6.1.1rc1",
        "6.2.0",
        "6.2.0rc1",
        "6.2.1",
        "6.2.1rc1",
        "6.2.2",
        "6.2.2rc1",
        "6.3.0",
        "6.3.0rc1",
        "6.3.0rc2",
        "6.3.1",
        "6.3.1rc1",
        "6.4.0rc1"
      ]
    }
  ],
  "aliases": [
    "CVE-2025-50213"
  ],
  "details": "Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) vulnerability in Apache Airflow Providers Snowflake.\n\nThis issue affects Apache Airflow Providers Snowflake: before 6.4.0.\n\nSanitation of table and stage parameters were added in\u00a0CopyFromExternalStageToSnowflakeOperator\u00a0to prevent\u00a0SQL injection\nUsers are recommended to upgrade to version 6.4.0, which fixes the issue.",
  "id": "PYSEC-2025-51",
  "modified": "2025-06-26T21:23:03.132527+00:00",
  "published": "2025-06-24T08:15:24+00:00",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/apache/airflow/pull/51734"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/2kqfmyt2pghg5f6797g8hzvq331v8qx3"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CVE-2025-50213 (GCVE-0-2025-50213)

Vulnerability from cvelistv5

fkie_cve-2025-50213

Vulnerability from fkie_nvd

ghsa-9r64-3wmc-x8m8

Vulnerability from github

pysec-2025-51

Vulnerability from pysec

Tags

Sightings

Nomenclature