A critical SQL injection flaw in the PyAthena library enables remote, unauthenticated attackers to exfiltrate data or execute unauthorized database commands.

The vulnerability exists in the DefaultParameterFormatter.format() function, which incorrectly escapes single quotes using backslashes. Because the underlying engines (Athena and Trino) do not recognize backslashes as escape characters, attackers can inject malicious SQL syntax to perform unauthorized operations.

This vulnerability carries a CVSS score of 9.8, reflecting its potential for severe impact. Successful exploitation could lead to the total compromise of database confidentiality and integrity, including large-scale data exfiltration, the execution of destructive SQL statements, and unauthorized control over database operations.

Immediate Action: Upgrade the PyAthena library to version 3.35.4 or later to implement the correct quote-escaping logic.

Proactive Monitoring: Audit database logs for unusual query patterns, particularly those involving unexpected UNION SELECT statements or modifications to CTAS destinations.

Compensating Controls: Implement strict input validation at the application layer to sanitize all user-supplied data before it is passed to the PyAthena library.

Public Exploit Available: No confirmed public weaponized exploit exists in the available data.

Given the ease with which SQL injection can be automated and the critical nature of the impact, organizations should immediately update PyAthena to the patched version. Applications relying on this library for database interactions should be reviewed to ensure they are not exposing sensitive database interfaces to untrusted user input.