CVE-2025-50213

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) vulnerability in Apache Airflow Providers Snowflake.

This issue affects Apache Airflow Providers Snowflake: before 6.4.0.

Sanitation of table and stage parameters were added in CopyFromExternalStageToSnowflakeOperator to prevent SQL injection Users are recommended to upgrade to version 6.4.0, which fixes the issue.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-75

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Airflow Providers Snowflake	< 6.4.0

References

https://github.com/apache/airflow/pull/51734Issue Tracking, Patch
https://lists.apache.org/thread/2kqfmyt2pghg5f6797g8hzvq331v8qx3Mailing List, Vendor Advisory

Timeline

Published: Jun 24, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-50226.5Weak Password Requirements vulnerability in Mitsubishi Electric Corporation photovoltaic system monitor “EcoGuideTAB” PV-DR004J all versions CVE-2025-502289.1Jizhicms v2.5.4 is vulnerable to Server-Side Request Forgery (SSRF) in User Evaluation, Message, and Comment modules.CVE-2025-502299.8Jizhicms v2.5.4 is vulnerable to SQL injection in the product editing module.CVE-2025-50237.1Use of Hard-coded Credentials vulnerability in Mitsubishi Electric Corporation photovoltaic system monitor “EcoGuideTAB” PV-DR004J all versi CVE-2025-502336.5A vulnerability in QCMS version 6.0.5 allows authenticated users to read arbitrary files from the server due to insufficient validation of t CVE-2025-502346.5MCCMS v2.7.0 has an SSRF vulnerability located in the index() method of the sys\apps\controllers\api\Gf.php file, where the pic parameter is CVE-2025-50247.4A flaw was found in gnome-remote-desktop. Once gnome-remote-desktop listens for RDP connections, an unauthenticated attacker can exhaust sys CVE-2025-502409.8nbcio-boot v1.0.3 was discovered to contain a SQL injection vulnerability via the userIds parameter at /sys/user/deleteRecycleBin.CVE-2025-50254.8libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when co CVE-2025-502519.1Server side request forgery (SSRF) vulnerability in makeplane plane 0.23.1 via the password recovery.CVE-2025-502557.8Cross Site Request Forgery (CSRF) vulnerability in Smartvista BackOffice SmartVista Suite 2.2.22 via crafted GET request.CVE-2025-502588.1Tenda AC6 v15.03.05.16_multi is vulnerable to Buffer Overflow in the SetSysTimeCfg function via the time parameter.