Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-123859— SQL Injection via unescaped DataFrame column names in Snowflake Connector for Python and Snowflake Connector for Python (Universal Core)

Quick assessment

Affected
Snowflake Snowflake Connector for Python
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

当通过非默认配置禁用标识符转义时，Snowflake Python 连接器及其通用核心版本（Universal Core）中的 数据加载功能在将 DataFrame 列名纳入生成的 SQL 语句之前，未对这些列名进行转义处理，从而导致 SQL 注入漏洞。在这两款产品中，攻击者可通过构造特定的列名，将额外的 SQL 语句附加到生成的语句上，进而可能利用该漏洞读取、修改或删除应用程序 Snowflake 角色有权访问的其他数据。利用此漏洞需要应用程序将攻击者可控的列名传递给该功能。修复方案已包含在 Snowflake

CVSS 8.1 · High

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-123859

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
SQL Injection via unescaped DataFrame column names in Snowflake Connector for Python and Snowflake Connector for Python (Universal Core)
Source: CVE Program / CVE List V5
Vulnerability Description
When identifier escaping is disabled through a non-default configuration, the write_pandas() data-loading functionality in the Snowflake Connector for Python and the Snowflake Connector for Python (Universal Core) did not escape DataFrame column names before including them in generated SQL, which could allow SQL injection. In both products, a crafted column name could have been used to chain additional SQL statements onto the generated statement, potentially allowing an attacker to read, modify, or delete other data accessible to the application's Snowflake role. Exploitation required an application to pass attacker controlled column names into this functionality. The fix is available in Snowflake Connector for Python version 4.8.1 and Snowflake Connector for Python (Universal Core) version 5.2.0. Users must upgrade manually.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Snowflake Snowflake Connector for Python 2.3.4 ~ 4.8.1 -
Snowflake Snowflake Connector for Python (Universal Core) 5.0.0b1 ~ 5.2.0 -

II. Public POCs for CVE-2026-123859

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-123859

请登录查看更多情报信息。

Other References for CVE-2026-123859 (2)

IV. Related Vulnerabilities

Same product: Snowflake Connector for Python
Same vendor: Snowflake
Same weakness: CWE-89