Malicious code in teak-snowflake-a2df (npm)

The package teak-snowflake-a2df was found to contain malicious code...

com.ascentstream.pulsar:bcfips-include-test (>=3.0.7.0-SNAPSHOT-a030c50 <=3.0.8.0-SNAPSHOT-16a7bcc), com.ascentstream.pulsar:bouncy-castle-bcfips (>=3.0.7.0-SNAPSHOT-a030c50 <=4.0.11.0) +13 more potentially affected by CVE-2025-8916 via org.bouncycastle:bcpkix-fips (>=1.0.5 <=2.0.11)

org.bouncycastle:bcpkix-fips MAVEN version =1.0.5, =3.0.7.0-SNAPSHOT-a030c50, =3.0.7.0-SNAPSHOT-a030c50, =2.1.2, =8.0.0, =1.2.0, =1.17.0, =1.17.0, =3.1.0, =3.0.0.1, =3.0.0.1, =3.13.14, =3.0.0, =1.0.4, =1.0.0, =19.0.0, =25.0.6 Source cves: CVE-2025-8916 Source advisory:...

The vulnerability of the CopyFromExternalStageToSnowflakeOperator() function in the Apache Airflow data integration with cloud platform providers Snowflake allows a hacker to execute arbitrary code.

The vulnerability of the CopyFromExternalStageToSnowflakeOperator function in the Apache Airflow integration with cloud data platforms involves improper elimination of special elements. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

SQL Injection

apache-airflow-providers-snowflake is vulnerable to SQL Injection. The vulnerability is due to failure to sanitize special elements due to improper sanitation of table and stage parameters in the CopyFromExternalStageToSnowflakeOperator component...

airflow-oracle-snowflake-plugin (>=0.1.0 <=0.1.2), airflow-provider-cloe (>=20221202.9.0 <=20221202.13.0) +4 more potentially affected by CVE-2025-50213 via apache-airflow-providers-snowflake (>=1.1.0 <=6.13.0)

apache-airflow-providers-snowflake PYPI version =1.1.0, =0.1.0, =20221202.9.0, =0.0.4, =0.1.0, =0.1.1 Source cves: CVE-2025-50213 Source advisory: OSV:GHSA-9R64-3WMC-X8M8...

Apache Airflow Providers Snowflake package allows for Special Element Injection via CopyFromExternalStageToSnowflakeOperator

Failure to Sanitize Special Elements into a Different Plane Special Element Injection vulnerability in Apache Airflow Providers Snowflake. This issue affects Apache Airflow Providers Snowflake: before 6.4.0. Sanitation of table and stage parameters were added...

GHSA-9R64-3WMC-X8M8 Apache Airflow Providers Snowflake package allows for Special Element Injection via CopyFromExternalStageToSnowflakeOperator

Failure to Sanitize Special Elements into a Different Plane Special Element Injection vulnerability in Apache Airflow Providers Snowflake. This issue affects Apache Airflow Providers Snowflake: before 6.4.0. Sanitation of table and stage parameters were added...

Security Bulletin: IBM App Connect Enterprise is vulnerable to Remote Code Execution and improper preservation of permissions due to jsonpath-plus & snowflake-sdk (CVE-2025-1302 & CVE-2025-24791)

Summary IBM App Connect Enterprise runtime, IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise Connector Discovery and OpenAPI Editor are vulnerable to Remote Code Execution RCE and improper preservation of permissions due to jsonpath-plus & snowflake-sdk. Vulnerabilit...

CVE-2025-50213

Failure to Sanitize Special Elements into a Different Plane Special Element Injection vulnerability in Apache Airflow Providers Snowflake. This issue affects Apache Airflow Providers Snowflake: before 6.4.0. Sanitation of table and stage parameters were added in...

CVE-2025-50213

Failure to Sanitize Special Elements into a Different Plane Special Element Injection vulnerability in Apache Airflow Providers Snowflake. This issue affects Apache Airflow Providers Snowflake: before 6.4.0. Sanitation of table and stage parameters were added...

PYSEC-2025-51

Failure to Sanitize Special Elements into a Different Plane Special Element Injection vulnerability in Apache Airflow Providers Snowflake.This issue affects Apache Airflow Providers Snowflake: before 6.4.0.Sanitation of table and stage parameters were added...

airflow-oracle-snowflake-plugin (>=0.1.0 <=0.1.2), airflow-provider-cloe (>=20221202.9.0 <=20221202.13.0) +4 more potentially affected by CVE-2025-50213 via apache-airflow-providers-snowflake (>=1.1.0 <=6.13.0)

apache-airflow-providers-snowflake PYPI version =1.1.0, =0.1.0, =20221202.9.0, =0.0.4, =0.1.0, =0.1.1 Source cves: CVE-2025-50213 Source advisory: OSV:PYSEC-2025-51...

PYSEC-2025-51

Failure to Sanitize Special Elements into a Different Plane Special Element Injection vulnerability in Apache Airflow Providers Snowflake. This issue affects Apache Airflow Providers Snowflake: before 6.4.0. Sanitation of table and stage parameters were added...

airflow-provider-cloe (>=20221202.9.0 <=20221202.13.0), astronomer-providers (=1.0.0) +2 more potentially affected by CVE-2025-50213 via apache-airflow-providers-snowflake (=6.13.0)

apache-airflow-providers-snowflake PYPI version =6.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-snowflake and may be impacted: - airflow-provider-cloe =20221202.9.0, =0.1.0, =0.1.1 Source cves: CVE-2025-50213 Source...

Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)

Overview apache-airflow-providers-snowflake is a Provider package apache-airflow-providers-snowflake for Apache Airflow Affected versions of this package are vulnerable to Failure to Sanitize Special Elements into a Different Plane Special Element Injection in the...

CVE-2025-50213 Apache Airflow Providers Snowflake: Potential SQL injection in CopyFromExternalStageToSnowflakeOperator

Failure to Sanitize Special Elements into a Different Plane Special Element Injection vulnerability in Apache Airflow Providers Snowflake. This issue affects Apache Airflow Providers Snowflake: before 6.4.0. Sanitation of table and stage parameters were added...

CVE-2025-50213

CVE-2025-50213 concerns Apache Airflow Providers Snowflake. The issue is a Special Element Injection caused by failure to sanitize special elements, affecting the CopyFromExternalStageToSnowflakeOperator and allowing SQL injection. Affected product: Apache Airflow Providers Snowflake prior to ver...

CVE-2025-50213 Apache Airflow Providers Snowflake: Potential SQL injection in CopyFromExternalStageToSnowflakeOperator

Failure to Sanitize Special Elements into a Different Plane Special Element Injection vulnerability in Apache Airflow Providers Snowflake. This issue affects Apache Airflow Providers Snowflake: before 6.4.0. Sanitation of table and stage parameters were added...

CVE-2025-50213 Apache Airflow Providers Snowflake: Potential SQL injection in CopyFromExternalStageToSnowflakeOperator

Failure to Sanitize Special Elements into a Different Plane Special Element Injection vulnerability in Apache Airflow Providers Snowflake. This issue affects Apache Airflow Providers Snowflake: before 6.4.0. Sanitation of table and stage parameters were added...

PT-2025-26707

Name of the Vulnerable Software and Affected Versions: Apache Airflow Providers Snowflake versions prior to 6.4.0 Description: The issue is related to a Failure to Sanitize Special Elements into a Different Plane, also known as Special Element Injection vulnerability. This vulnerability affects t...