CVE-2026-15062 Details
Description
SQL injection vulnerabilities in the Snowflake Snowpark Python SDK (snowpark-python) versions prior to 1.53.0 could allow authenticated low-privilege users to execute SQL beyond their authorization scope. An attacker could exploit these vulnerabilities by embedding SQL payloads in source database column names to escalate privileges via the DataFrameReader.dbapi() API by supplying a specially crafted location parameter to DataFrameWriter write methods to redirect a COPY INTO to an arbitrary source query, or by including a backslash-single-quote sequence in an export path to defeat the normalize_path() sanitizer and inject SQL via DataFrame.to_csv(). Successful exploitation may result in source database compromise, unauthorized cross-tenant data exfiltration, or unauthorized read of Snowflake account data.
A SQL injection vulnerability has been identified in the Snowflake Snowpark Python SDK (snowpark-python) versions prior to 1.53.0. This vulnerability could allow authenticated low-privilege users to execute SQL commands beyond their authorized scope. The issue arises from improper handling of SQL payloads embedded in source database column names, which can be exploited through the DataFrameReader.dbapi() API. By supplying a crafted location parameter to DataFrameWriter write methods, an attacker could redirect a COPY INTO command to an arbitrary source query, or inject SQL via the DataFrame.to_csv() method by including a backslash-single-quote sequence in the export path to bypass the normalize_path() sanitizer. Successful exploitation may lead to unauthorized access and manipulation of source database data, cross-tenant data exfiltration, or unauthorized reading of Snowflake account data.
Users should update to Snowflake Snowpark Python SDK version 1.53.0 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/snowflakedb/snowpark-python/blob/main/CHANGELOG.md | SNOWFLAKE |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | SNOWFLAKE |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 8, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2026 | New CVE Received | SNOWFLAKE |