CVE-2026-65321 is a critical SQL injection vulnerability in PyAthena before version 3.35.4. The vulnerability stems from improper quote-escaping in DefaultParameterFormatter.format(), which routes DELETE and CTAS statements to a function that backslash-escapes single quotes rather than doubling them. Because Athena and Trino do not treat backslashes as escape characters inside string literals, attacker input containing a single quote followed by SQL syntax can prematurely terminate the string literal. This enables attackers to perform UNION SELECT queries for data exfiltration, execute destructive SQL commands, and control CTAS statement destinations and contents.

An unauthenticated attacker can exploit this vulnerability to inject arbitrary SQL commands. This can lead to unauthorized data access and exfiltration, execution of destructive SQL statements that may alter or delete data, and creation of attacker-controlled tables. The vulnerability affects the confidentiality, integrity, and availability of data accessed via PyAthena.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using vulnerable versions of PyAthena in untrusted environments. Review and restrict the use of DELETE and CTAS statements where possible. Monitor vendor channels for updates and apply patches promptly once released.