PT-2026-67262 · Pypi · Pyathena

Rahul Karne · CVE-2026-65321 · Published 2026-08-02 · Updated 2026-08-02

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PyAthena versions prior to 3.35.4

Description Unauthenticated attackers can inject arbitrary SQL due to improper quote-escaping in the DefaultParameterFormatter.format() function. Specifically, DELETE and CTAS statements are routed to the escape hive() function, which uses backslashes to escape single quotes instead of doubling them. Since Athena and Trino do not recognize backslashes as escape characters within string literals, a single quote in the input can prematurely terminate the string literal. This allows for data exfiltration via UNION SELECT, the execution of destructive statements, and unauthorized control over CTAS destination and content.

Recommendations Update PyAthena to version 3.35.4 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-65321

GHSA-XWJ5-G6CV-4R5C

Affected Products

Pyathena

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/65xxx/CVE-2026-65321.json · Exploit
• https://github.com/laughingman7743/PyAthena/security/advisories/GHSA-xwj5-g6cv-4r5c · Vendor Advisory
• https://github.com/pyathena-dev/PyAthena/commit/27901d12245ea722b3b4e211c60e2ade4e7c8efd · Patch
• https://osv.dev/vulnerability/CVE-2026-65321 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-65321 · Security Note
• https://github.com/laughingman7743/PyAthena · Note
• https://vulncheck.com/advisories/pyathena-sql-injection-via-defaultparameterformatter-delete-ctas · Note