Snowflake Connector for Python SQL injection via DataFrame column names
Python programs that use Snowflake data could have their data read, changed, or deleted.
Summary
The write_pandas() function does not escape DataFrame column names, so an attacker-crafted column name can chain extra SQL statements. It applies only when identifier escaping is disabled through a non-default configuration, and to applications that pass attacker-controlled column names into it.
Affected when
- Identifier escaping disabled through a non-default configuration
- Application passes attacker-controlled column names to write_pandas()
What to do
Upgrade Snowflake Connector for Python to 4.8.1 and Snowflake Connector for Python (Universal Core) to 5.2.0; users must upgrade manually.
Update to at least the version for your product:
- Snowflake Connector for Python 4.8.1 or later
- Snowflake Connector for Python (Universal Core) 5.2.0 or later
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen