CVE-2026-65321

Name of the Vulnerable Software and Affected Versions PyAthena versions prior to 3.35.4

Description Unauthenticated attackers can inject arbitrary SQL due to improper quote-escaping in the DefaultParameterFormatter.format() function. Specifically, DELETE and CTAS statements are routed to the escape hive() function, which uses backslashes to escape single quotes instead of doubling them. Since Athena and Trino do not recognize backslashes as escape characters within string literals, a single quote in the input can prematurely terminate the string literal. This allows for data exfiltration via UNION SELECT, the execution of destructive statements, and unauthorized control over CTAS destination and content.

Recommendations Update PyAthena to version 3.35.4 or later.