AIKIDO-2026-845159

TL;DR

PyAthena builds parameterized SQL through DefaultParameterFormatter, which chooses an escaping strategy for each statement. Only SELECT, WITH, INSERT, UPDATE, and MERGE route to the Trino-safe escaper (quote-doubling); every other statement — including DELETE and CTAS (CREATE TABLE ... AS SELECT) — falls through to the Hive escaper, which backslash-escapes single quotes instead of doubling them. Because Athena and Trino do not treat backslashes as escape characters inside string literals, an externally influenced string value can terminate a literal early and inject arbitrary SQL, enabling data exfiltration and destructive statements. The fix selects the escaper by statement type so non-Hive statements use quote-doubling, and it strips leading comments before making that decision.