CVE-2026-65321 Details

A SQL injection vulnerability has been identified in PyAthena versions prior to 3.35.4. The issue arises in the DefaultParameterFormatter.format() method, which improperly escapes quotes in DELETE and CTAS (CREATE TABLE AS SELECT) statements. This flaw allows unauthenticated attackers to inject arbitrary SQL. The vulnerability exploits the fact that Athena and Trino do not recognize backslashes as escape characters within string literals. By supplying input such as a single quote followed by SQL syntax, an attacker can prematurely terminate a string literal, leading to SQL injection. The consequences include data exfiltration via UNION SELECT, execution of destructive SQL statements, and manipulation of CTAS destinations and content.

Users can upgrade to PyAthena version 3.35.4, which addresses the vulnerability by correcting the quote-escaping method for DELETE and CTAS statements. Alternatively, until an upgrade is possible, avoid using untrusted parameter values in DELETE or CTAS statements.