Vulnerability	Vulnerable Version
C SQL Injection PyAthena is a Python DB API 2.0 (PEP 249) client for Amazon Athena Affected versions of this package are vulnerable to SQL Injection through its escaper selection for `DELETE` and `CREATE TABLE ... AS SELECT` statements. An attacker can break out of a parameterized string literal and inject arbitrary SQL by supplying a value containing a single quote in a `DELETE` or CTAS query. The vulnerable code routes those statements to the Hive-style backslash escaper, but Athena/Trino parses backslashes as ordinary characters inside string literals, so the injected quote terminates the literal and lets the attacker-controlled SQL run. This can expose or modify data in the target query context and, depending on the caller’s privileges, execute destructive statements against Athena-backed tables. How to fix SQL Injection? Upgrade `PyAthena` to version 3.35.4 or higher.	[,3.35.4)

SQL Injection

PyAthena is a Python DB API 2.0 (PEP 249) client for Amazon Athena

Affected versions of this package are vulnerable to SQL Injection through its escaper selection for DELETE and CREATE TABLE ... AS SELECT statements. An attacker can break out of a parameterized string literal and inject arbitrary SQL by supplying a value containing a single quote in a DELETE or CTAS query. The vulnerable code routes those statements to the Hive-style backslash escaper, but Athena/Trino parses backslashes as ordinary characters inside string literals, so the injected quote terminates the literal and lets the attacker-controlled SQL run. This can expose or modify data in the target query context and, depending on the caller’s privileges, execute destructive statements against Athena-backed tables.

How to fix SQL Injection?

Upgrade PyAthena to version 3.35.4 or higher.

[,3.35.4)

Go back to all versions of this package