—

PYSEC-2025-26

Quick fix

PYSEC-2025-26 — snowflake-connector-python: upgrade to the fixed version with the command below.

pip install --upgrade 'snowflake-connector-python>=f3f9b666518d29c31a49384bbaa9a65889e72056'

Details

The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. A function from the snowflake.connector.pandas_tools module is vulnerable to SQL injection. This vulnerability affects versions 2.2.5 through 3.13.0. Snowflake fixed the issue in version 3.13.1.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/snowflake-connector-python

Introduced in: 0Fixed in: f3f9b666518d29c31a49384bbaa9a65889e72056

Fixpip install --upgrade 'snowflake-connector-python>=f3f9b666518d29c31a49384bbaa9a65889e72056'

References

https://github.com/snowflakedb/snowflake-connector-python/security/advisories/GHSA-2vpq-fh52-j3wv[ADVISORY]
https://github.com/snowflakedb/snowflake-connector-python/commit/f3f9b666518d29c31a49384bbaa9a65889e72056[FIX]