n8n: Snowflake Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation

Impact The n8n Snowflake node's Execute Query operation interpolated expression values directly into the SQL string, making queries built with untrusted data susceptible to SQL injection. Exploitation requires that a workflow author has already embedded untrusted expression data directly in a raw...

GHSA-652Q-GVQ3-74QV n8n: Snowflake Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation

Impact The n8n Snowflake node's Execute Query operation interpolated expression values directly into the SQL string, making queries built with untrusted data susceptible to SQL injection. Exploitation requires that a workflow author has already embedded untrusted expression data directly in a raw...

PT-2026-67352

Impact The n8n Snowflake node's Execute Query operation interpolated expression values directly into the SQL string, making queries built with untrusted data susceptible to SQL injection. Exploitation requires that a workflow author has already embedded untrusted expression data directly in a raw...

PT-2026-70163

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.67 n8n versions prior to 2.31.5 n8n versions prior to 2.32.1 Description A SQL injection issue exists in the Snowflake node's Execute Query operation. The system interpolates expression values directly into the SQL...

Malicious Package

Overview CData.Snowflake.EntityFramework.Net is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization an...

CVE-2026-15925

A flaw was found in Snowflake Connector for Python. A network-positioned attacker could exploit improper Transport Layer Security TLS hostname verification by intercepting network traffic and presenting a fraudulent certificate. This could allow the attacker to bypass certificate hostname...

datupapi (>=0.5.19, <=1.0.3) potentially affected by CVE-2026-15925 via snowflake-connector-python (2.5.0)

snowflake-connector-python PYPI version 2.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - datupapi =0.5.19, =1.0.3 Source cves: CVE-2026-15925 Source advisory: OSV:GHSA-5CC2-282F-JJQ2...

cdwutils (>=1.13.21, <=1.13.29), dbd (>=0.6.8, <=0.8.9) +30 more potentially affected by CVE-2026-15925 via snowflake-connector-python (2.9.0)

snowflake-connector-python PYPI version 2.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - cdwutils =1.13.21, =0.6.8, =0.1.0, =0.5.0, =0.1.28, =2.1.0, =1.0.60b0, =0.0.1, =0.2.0, =0.1.0, =0.1.0, =1.0....

acedeploy (>=2.4.15, <=2.4.366.dev1), acepolicies (>=0.1.17, <=0.1.23) +98 more potentially affected by CVE-2026-15925 via snowflake-connector-python (>=3.0.0, <=3.18.0)

snowflake-connector-python PYPI version =3.0.0, =2.4.15, =0.1.17, =0.0.1.dev7, =0.1.0.dev1, =0.0.1a4.post0, =1.0.6, =1.0.23, =0.1.3, =0.1.0, =1.0.1, =20241210.4.0, =20231128.1.0, =20240129.2.0 and more Source cves: CVE-2026-15925 Source advisory: GHSA-5CC2-282F-JJQ2...

database-factory (>=1.0.5, <=1.0.6), rcd-dev-kit (>=1.4.0, <=2.0.4) potentially affected by CVE-2026-15925 via snowflake-connector-python (2.7.9)

snowflake-connector-python PYPI version 2.7.9 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - database-factory =1.0.5, =1.4.0, =2.0.4 Source cves: CVE-2026-15925 Source advisory: OSV:GHSA-5CC2-282F-JJQ2...

ewah (>=0.1.25, <=0.2.5), fivetran-autogen (>=0.0.1rc8, <=0.0.1rc9) +6 more potentially affected by CVE-2026-15925 via snowflake-connector-python (2.0.2)

snowflake-connector-python PYPI version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - ewah =0.1.25, =0.0.1rc8, =0.0.2, =2.2.0, =0.14.1, =0.110.1, =2.0.0, =2.1.0 - spswarehouse-airflow 0.6.3 Sour...

pipelinewise-tap-snowflake (>=1.1.1, <=2.0.0) potentially affected by CVE-2026-15925 via snowflake-connector-python (2.2.2)

snowflake-connector-python PYPI version 2.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - pipelinewise-tap-snowflake =1.1.1, =2.0.0 Source cves: CVE-2026-15925 Source advisory: OSV:GHSA-5CC2-282F-JJ...

monosi (>=0.0.1.post1, <=0.0.2.post5), monosi-server (0.0.1) +1 more potentially affected by CVE-2026-15925 via snowflake-connector-python (2.7.2)

snowflake-connector-python PYPI version 2.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - monosi =0.0.1.post1, =0.0.2.post5 - monosi-server 0.0.1 - snowshu 0.0.4a1 Source cves: CVE-2026-15925 Source...

pipelinewise-tap-snowflake (2.0.1), snowday (>=0.1.3, <=0.1.5) potentially affected by CVE-2026-15925 via snowflake-connector-python (2.2.9)

snowflake-connector-python PYPI version 2.2.9 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - pipelinewise-tap-snowflake 2.0.1 - snowday =0.1.3, =0.1.5 Source cves: CVE-2026-15925 Source advisory:...

dbt (>=0.20.0b1, <=0.20.2), dbt-osmosis (>=0.2.0, <=0.2.1) +5 more potentially affected by CVE-2026-15925 via snowflake-connector-python (2.4.6)

snowflake-connector-python PYPI version 2.4.6 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - dbt =0.20.0b1, =0.2.0, =0.20.0b1, =1.13.0, =0.2.0a0, =2.9.1, =0.0.2a1, =0.0.2rc4 Source cves: CVE-2026-15925...

target-snowflake (0.0.0) potentially affected by CVE-2026-15925 via snowflake-connector-python (1.8.7)

snowflake-connector-python PYPI version 1.8.7 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - target-snowflake 0.0.0 Source cves: CVE-2026-15925 Source advisory: OSV:GHSA-5CC2-282F-JJQ2...

snowchange (>=0.0.1, <=0.0.4.post1) potentially affected by CVE-2026-15925 via snowflake-connector-python (2.2.6)

snowflake-connector-python PYPI version 2.2.6 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - snowchange =0.0.1, =0.0.4.post1 Source cves: CVE-2026-15925 Source advisory: OSV:GHSA-5CC2-282F-JJQ2...

piicatcher (>=0.10.1, <=0.12.1) potentially affected by CVE-2026-15925 via snowflake-connector-python (2.2.7)

snowflake-connector-python PYPI version 2.2.7 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - piicatcher =0.10.1, =0.12.1 Source cves: CVE-2026-15925 Source advisory: OSV:GHSA-5CC2-282F-JJQ2...

GHSA-5CC2-282F-JJQ2 Snowflake Connector for Python improperly verifies TLS hostnames

Improper TLS hostname verification in Snowflake Connector for Python versions prior to 4.7.1 and 3.18.1 may have allowed a network-positioned attacker to bypass certificate hostname validation on HTTPS connections made by the connector. An attacker with on-path network access could exploit this b...

kpc-nifi-utils (0.2.3) potentially affected by CVE-2026-15925 via snowflake-connector-python (2.0.0)

snowflake-connector-python PYPI version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - kpc-nifi-utils 0.2.3 Source cves: CVE-2026-15925 Source advisory: OSV:GHSA-5CC2-282F-JJQ2...