What is CVE-2026-65321?
A SQL injection vulnerability has been found in PyAthena versions prior to 3.35.4. It allows unauthenticated attackers to inject arbitrary SQL by exploiting improper quote-escaping in DefaultParameterFormatter.format(), which routes DELETE and CTAS statements to the vulnerable _escape_hive function. Users should immediately upgrade to version 3.35.4 or later.
Azərbaycanca: PyAthena-nın 3.35.4-dən əvvəlki versiyalarında SQL injection zəifliyi aşkarlanıb. Bu, autentifikasiya olunmamış hücumçulara DefaultParameterFormatter.format() funksiyasındakı dırnaq işarələrinin düzgün escap edilməməsi səbəbindən ixtiyari SQL sorğuları yeritməyə imkan verir. İstifadəçilər dərhal 3.35.4 və ya daha yuxarı versiyaya yeniləməlidir.
Related CVEs
link basis: same weakness class CWE-89
FAQ2
In which PyAthena function was the SQL injection vulnerability discovered?
The SQL injection vulnerability occurs in the DefaultParameterFormatter.format() function due to improper quote-escaping.
Which version of PyAthena should users upgrade to in order to fix CVE-2026-65321?
Users should upgrade PyAthena to version 3.35.4 or later.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.