CVE-2026-65321

EIP tracks 1 public exploit for CVE-2026-65321. PoCs published by rahulreddykarne.

AI-analyzed exploit summary This repository contains a functional proof-of-concept demonstrating a SQL injection vulnerability (CVE-2026-65321) in PyAthena <= 3.35.3. The exploit shows how improper backslash-escaping in non-SELECT statements (e.g., DELETE, CREATE TABLE AS) allows attackers to break out of string literals and inject arbitrary SQL, leading to unauthorized data deletion or exfiltration.

PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unauthenticated attackers to inject arbitrary SQL by exploiting improper quote-escaping in DefaultParameterFormatter.format(), which routes DELETE and CTAS statements to the _escape_hive function that backslash-escapes single quotes rather than doubling them. Because Athena and Trino do not treat backslashes as escape characters inside string literals, attacker-supplied input such as a single quote followed by SQL syntax causes the parser to terminate the string literal prematurely, enabling data exfiltration via UNION SELECT, execution of destructive statements, and attacker-controlled CTAS destination and content.