What’s Vulnerable › Vulnerabilities

CVE-2025-50213: Apache Airflow Providers Snowflake: Potential SQL injection in CopyFromExternalStageToSnowflakeOperator

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-06-24 · updated 2026-06-17
• Weakness: CWE-75

Description

Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) vulnerability in Apache Airflow Providers Snowflake. This issue affects Apache Airflow Providers Snowflake: before 6.4.0. Sanitation of table and stage parameters were added in CopyFromExternalStageToSnowflakeOperator to prevent SQL injection Users are recommended to upgrade to version 6.4.0, which fixes the issue.

Affected products

• Apache Software Foundation Apache Airflow Snowflake provider: before 6.4.0 — fixed in 6.4.0

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Airflow Snowflake provider 6.4.0. Check the vendor advisory for mitigations.

References

• https://github.com/apache/airflow/pull/51734
• https://lists.apache.org/thread/2kqfmyt2pghg5f6797g8hzvq331v8qx3

Get alerted when CVE-2025-50213 or the next vulnerability affects your stack