Read the docs
TI-2026-12678 Aliases CVE-2026-15062GHSA-872q-cxrp-279p

SQL Injection in Snowflake Snowpark Python SDK

Priority MEDIUM 43CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

SQL injection vulnerabilities in the Snowflake Snowpark Python SDK (snowpark-python) versions prior to 1.53.0 could allow authenticated low-privilege users to execute SQL beyond their authorization scope. An attacker could exploit these vulnerabilities by embedding SQL payloads in source database column names to escalate privileges via the DataFrameReader.dbapi() API by supplying a specially crafted location parameter to DataFrameWriter write methods to redirect a COPY INTO to an arbitrary source query, or by including a backslash-single-quote sequence in an export path to defeat the normalize_path() sanitizer and inject SQL via DataFrame.to_csv(). Successful exploitation may result in source database compromise, unauthorized cross-tenant data exfiltration, or unauthorized read of Snowflake account data.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00386 32nd percentileScored 2026-11-07
Fix Fixed Snowpark Python SDK (Snowflake): 1.53.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SnowflakeSnowpark Python SDK0.1.0 to before 1.53.01.53.0Patch availableCNA
  • Snowpark Python SDK VendorSnowflake Affected 0.1.0 to before 1.53.0 Fixed in 1.53.0 Patch available CNA

Remediation

  • Fix · CNA Snowpark Python SDK (Snowflake) Fixed in 1.53.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-15062
  2. 2026-10-03 Alias added: GHSA-872q-cxrp-279p

References

Other 1

  • TI-2022-20945 Exponential ReDoS in snowflake-connector-python leads to denial of service CVSS 3.1HIGH 7.5
  • TI-2026-02844 snowflakedb snowflake-jdbc JDBC URL SdkProxyRoutePlanner.java SdkProxyRoutePlanner redos CVSS 4.0MEDIUM 4.8
  • TI-2026-13340 Improper TLS Hostname Verification in Snowflake Connector for Python CVSS 4.0CRITICAL 9.2
  • TI-2026-09272 Streamlit Palette hashing.py weak hash CVSS 4.0LOW 2.0
  • TI-2023-17069 Snowflake Python Connector vulnerable to Command Injection CVSS 3.1HIGH 8.8
  • TI-2023-17068 Snowflake NodeJS Driver vulnerable to Command Injection CVSS 3.1HIGH 8.8
See all 55 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences