Snowflake Connector for Python vulnerabilities

When identifier escaping is disabled through a non-default configuration, the write_pandas() data-loading functionality in Snowflake Connector for Python and Snowflake Connector for Python (Universal Core) did not escape DataFrame column names before including them in generated SQL, potentially allowing SQL injection. A crafted column name could chain additional SQL statements, allowing an attacker to read, modify, or delete other data accessible to the application's Snowflake role.

Snowflake Connector for Python versions prior to 4.7.1 and 3.18.1 lack proper TLS hostname verification. An attacker with on-path network access could intercept or redirect HTTPS traffic and present a certificate signed by any trusted CA for any domain, causing the connector to accept connections without validating the certificate matches the requested hostname.

The Snowflake Connector for Python in versions prior to 3.0.2 is vulnerable to command injection via SSO browser URL authentication. An attacker can exploit a malicious resource to redirect users to a malicious URL, potentially leading to remote code execution.