CVE-2025-24793 – The Snowflake Connector for Python contains a S... (How to Fix)

📋 TL;DR

The Snowflake Connector for Python contains a SQL injection vulnerability in the snowflake.connector.pandas_tools module. This allows attackers to execute arbitrary SQL commands on Snowflake databases when using vulnerable functions. Applications using versions 2.2.5 through 3.13.0 of the connector are affected.

💻 Affected Systems

Products:

Snowflake Connector for Python

Versions: 2.2.5 through 3.13.0

Operating Systems: All platforms running Python

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects applications using functions from snowflake.connector.pandas_tools module with untrusted input

📦 What is this software?

Snowflake Connector by Snowflake

View all CVEs affecting Snowflake Connector →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Full database compromise including data theft, data manipulation, privilege escalation, and potential lateral movement within Snowflake environment

🟠

Likely Case

Data exfiltration from accessible tables, data corruption, or unauthorized query execution

🟢

If Mitigated

Limited to read-only operations on accessible data if proper database permissions are configured

🌐 Internet-Facing: MEDIUM - Requires application to expose vulnerable function with user input

🏢 Internal Only: MEDIUM - Internal applications using vulnerable connector could be exploited by authenticated users

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires application to pass user-controlled input to vulnerable pandas_tools functions

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 3.13.1

Vendor Advisory: https://github.com/snowflakedb/snowflake-connector-python/security/advisories/GHSA-2vpq-fh52-j3wv

Restart Required: No

Instructions:

1. Update snowflake-connector-python package using pip: pip install --upgrade snowflake-connector-python==3.13.1
2. Verify no applications are pinned to vulnerable versions
3. Test application functionality after update

🔧 Temporary Workarounds

Input Validation and Parameterization

all

Implement strict input validation and use parameterized queries instead of string concatenation

🧯 If You Can't Patch

Implement strict input validation and sanitization for all user inputs passed to pandas_tools functions
Apply principle of least privilege to Snowflake database users and restrict permissions

🔍 How to Verify

Check if Vulnerable:

Check installed version: pip show snowflake-connector-python | grep Version

Check Version:

python -c "import snowflake.connector; print(snowflake.connector.__version__)"

Verify Fix Applied:

Confirm version is 3.13.1 or higher: pip list | grep snowflake-connector-python

📡 Detection & Monitoring

Log Indicators:

Unusual SQL queries from application users
Multiple failed query attempts with SQL syntax errors
Queries containing unexpected SQL keywords or special characters

Network Indicators:

Unusually large data transfers from Snowflake database
Multiple rapid SQL queries from single source

SIEM Query:

source="snowflake_logs" AND (query CONTAINS "UNION" OR query CONTAINS "SELECT *" OR query CONTAINS "DROP" OR query CONTAINS "INSERT") AND NOT query MATCHES expected_pattern

📊 Metadata

CVE ID: CVE-2025-24793

CVSS v3 Score: 7.0 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-89

EPSS Score: 0.1% exploit probability (28.1th percentile)

Published: January 29, 2025

Last Updated: August 25, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-24793, you might also want to check these: