Snowflake Python Connector EUVD-2026-118319

Two conditions must both hold: (1) the Snowflake Connector for Python or Universal Core must be running with identifier escaping disabled, which the vendor states is a non-default configuration; and (2) the calling application must pass attacker-controlled DataFrame column names into the write_pandas() data-loading function. Exploitation is therefore limited to deployments that have explicitly turned off identifier escaping AND whose application code routes untrusted input into column names of DataFrames passed to write_pandas(); default-configuration installations that escape identifiers are not exploitable. Impact is bounded by the privileges of the application's Snowflake role. The only complete fix per the vendor is upgrading to Connector for Python 4.8.1 or Universal Core 5.2.0, and users must upgrade manually.

This is a genuine high-severity injection flaw (CVSS 8.1, CWE-89) but one whose real-world exploitability is sharply constrained by preconditions, so it should be treated as important-to-patch rather than a drop-everything emergency. The vuln.today decision label is 'this_week', consistent with a serious-but-conditional issue. No EPSS score, no CISA KEV listing, and no proof-of-concept or exploit reference were supplied - the only references are Snowflake's own release notes - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The CVSS vector (AV:N/AC:H/PR:N/UI:N) reports no privileges required, but AC:H reflects the two stacked conditions the description makes explicit: the connector must be run with identifier escaping disabled via a non-default configuration, AND the calling application must pass attacker-controlled DataFrame column names into write_pandas(). The full C:H/I:H/A:H impact is credible because successful injection runs arbitrary SQL under the application's Snowflake role, which can read, modify, or delete any data that role can reach. Net: the signals are internally consistent - a high potential impact gated behind a non-default configuration and an application data-flow precondition - so prioritize it where those conditions can occur, but it is not a wormable, default-configuration remote exploit.

An application using the Snowflake Connector for Python, configured with identifier escaping disabled, builds a pandas DataFrame from a source whose column names come from untrusted input (e.g. an uploaded CSV header or a user-defined schema) and loads it via write_pandas(). An attacker sets a column name containing SQL syntax that chains an additional statement onto the generated INSERT/load SQL, which then executes under the application's Snowflake role to exfiltrate or delete data. No public exploit code is identified, and the high attack complexity reflects the non-default configuration plus the requirement that the application funnel attacker-controlled column names into this path.