CVE-2025-24793CWE-89

Snowflake Connector for Python has an SQL Injection in write_pandas

High · published January 29, 2025

CVSS v3.1
7.0
EPSS
0%
Percentile
22.5
In the wild
Unconfirmed
What it is

The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. A function from the snowflake.connector.pandas_tools module is vulnerable to SQL injection. This vulnerability affects versions 2.2.5 through 3.13.0. Snowflake fixed the issue in version 3.13.1.

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00309 · 22.5th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-01-29T20:23Z
EPSS history
Timeline
  • 29 JAN 20:23Z
    Snowflake Connector for Python has an SQL Injection in write_pandas
    cvelistv5