CVE-2026-65321-pyathena

CVE-2026-65321: SQL Injection in PyAthena via Backslash Quote-Escaping for Non-SELECT Statements Severity: Critical, CVSS v4.0 9.3 / CVSS v3.1 9.8 assigned by VulnCheck, the CNA Vector v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Vector v3.1:...

CLEANSTART-2026-WC06247 PyAthena prior to 3

CVE-2026-65321 affects multiple packages. PyAthena prior to 3. See references for individual vulnerability details...

baram (>=0.3.2, <=0.3.7), basejump (>=0.1.7, <=0.3.1) +14 more potentially affected by CVE-2026-65321 via pyathena (>=3.0.5, <=3.34.0)

pyathena PYPI version =3.0.5, =0.3.2, =0.1.7, =0.31.6, =1.1.135, =3.0.0, =6.0.5, =0.1.2, =9.0.0, =0.2.0, =1.0.0, =0.1.0, =1.11.0, =1.11.0, =0.1.1, =0.2.8 and more Source cves: CVE-2026-65321 Source advisory: SNYK:PYTHON-PYATHENA-19270043...

SQL Injection

Overview PyAthena is a Python DB API 2.0 PEP 249 client for Amazon Athena Affected versions of this package are vulnerable to SQL Injection through its escaper selection for DELETE and CREATE TABLE ... AS SELECT statements. An attacker can break out of a parameterized string literal and inject...

CVE-2026-65321

PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unauthenticated attackers to inject arbitrary SQL by exploiting improper quote-escaping in DefaultParameterFormatter.format, which routes DELETE and CTAS statements to the escapehive function that backslash-escapes single...

CVE-2026-65321 PyAthena SQL Injection via DefaultParameterFormatter DELETE/CTAS

PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unauthenticated attackers to inject arbitrary SQL by exploiting improper quote-escaping in DefaultParameterFormatter.format, which routes DELETE and CTAS statements to the escapehive function that backslash-escapes single...

amundsen-databuilder (>=1.4.11, <=1.4.13), athenacli (>=0.1.0, <=0.1.1) +36 more potentially affected by CVE-2026-65321 via pyathena (>=1.2.2, <=3.34.0)

pyathena PYPI version =1.2.2, =1.4.11, =0.1.0, =0.3.2, =0.1.7, =0.31.6, =0.1.17, =0.0.5, =1.1.135, =3.0.0, =6.0.5, =0.1.2, =9.0.0, =0.2.0, =1.0.0, =2.0.1 - cumulus-library-pcx 0.4.0 and more Source cves: CVE-2026-65321 Source advisory: MEND:CVE-2026-65321...

CVE-2026-65321

PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unauthenticated attackers to inject arbitrary SQL by exploiting improper quote-escaping in DefaultParameterFormatter.format, which routes DELETE and CTAS statements to the escapehive function that backslash-escapes single...

CVE-2026-65321

CVE-2026-65321 affects PyAthena prior to 3.35.4. The vulnerability stems from improper quote escaping in DefaultParameterFormatter.format(), where DELETE and CTAS flows go through _escape_hive and backslash-escape single quotes instead of doubling them. Because Athena and Trino do not treat backs...

EUVD-2026-52004

PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unauthenticated attackers to inject arbitrary SQL by exploiting improper quote-escaping in DefaultParameterFormatter.format, which routes DELETE and CTAS statements to the escapehive function that backslash-escapes single...

CVE-2026-65321

PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unauthenticated attackers to inject arbitrary SQL by exploiting improper quote-escaping in DefaultParameterFormatter.format, which routes DELETE and CTAS statements to the escapehive function that backslash-escapes single...

CVE-2026-65321 PyAthena SQL Injection via DefaultParameterFormatter DELETE/CTAS

PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unauthenticated attackers to inject arbitrary SQL by exploiting improper quote-escaping in DefaultParameterFormatter.format, which routes DELETE and CTAS statements to the escapehive function that backslash-escapes single...

CVE-2026-65321: Improper Neutralization of Special Elements used in an SQL Command

PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unauthenticated attackers to inject arbitrary SQL by exploiting improper quote-escaping in DefaultParameterFormatter.format, which routes DELETE and CTAS statements to the escapehive function that backslash-escapes single...