Threats tagged 'ghsa-wfjf-896m-7r59'

A SQL injection vulnerability exists in the write_pandas() data-loading functionality of the Snowflake Connector for Python and Snowflake Connector for Python (Universal Core) when identifier escaping is disabled via a non-default configuration. This flaw allows crafted DataFrame column names to be included unescaped in generated SQL statements, enabling an attacker to append additional SQL commands. Exploitation requires attacker-controlled column names passed to this function. The vulnerability can lead to unauthorized reading, modification, or deletion of data accessible to the application's Snowflake role. Fixed versions are 4.8.1 for Snowflake Connector for Python and 5.2.0 for the Universal Core variant.