Snowpark Python EUVD-2026-42282

Exploitation requires an authenticated Snowflake session using Snowpark Python (PR:L confirmed by CVSS), plus one of three concrete triggers named in the description: (1) DataFrameReader.dbapi() reading from a source database whose column names the attacker can influence, (2) a specially crafted location parameter supplied to a DataFrameWriter write method to redirect COPY INTO to an arbitrary source query, or (3) a backslash-single-quote sequence embedded in an export path passed to DataFrame.to_csv() to defeat the normalize_path() sanitizer. Limiting factors: the attacker must already hold low-privilege access and be able to place their payload into one of these specific parameters or data sources, and the target must run snowpark-python below 1.53.0 - there is no unauthenticated or default-configuration path, and no user interaction is required beyond the vulnerable pipeline executing.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C, C:H/I:H/A:N, score 9.6) indicates a network-reachable, low-complexity attack requiring only low privileges, with a scope change reflecting cross-tenant / source-database impact and high confidentiality and integrity loss but no availability impact. Because the vector contains PR:L this is an authenticated attack - not a pre-auth internet-facing scenario; the attacker must already hold a low-privilege Snowflake identity or control input that a Snowpark job ingests (e.g. attacker-controlled source database column names). No EPSS score was provided, there is no KEV listing (no public exploit identified at time of analysis), and no POC reference, so real-world exploitation signal is currently absent despite the high CVSS. The single reference is only the project CHANGELOG, so exploitation prerequisites are inferred from the description rather than confirmed by an independent advisory; treat the 9.6 as a credible worst case for multi-tenant Snowflake data pipelines but verify actual API usage and exposure before emergency prioritization.

A low-privilege user in a shared Snowflake account (or an attacker who controls a source database that a Snowpark job ingests) crafts a malicious column name or a location/export-path parameter containing SQL, then triggers a Snowpark read/write that concatenates it into generated SQL. The injected statement runs with the session's privileges, allowing the attacker to redirect a COPY INTO or read data belonging to other tenants. No public POC is referenced, but the low attack complexity and network vector make weaponization straightforward for an authenticated actor.