Wiz AI finds Snowflake connector flaw missed by GitHub security

RESEARCHERS from Wiz, a part of Google Cloud, identified a critical script injection vulnerability in a public GitHub repository for Snowflake's connector. This vulnerability, which went unnoticed by GitHub's Advanced Security, allows unauthenticated users to execute commands via GitHub Actions. Wiz's AI-powered tool, Red Agent, discovered and exploited the flaw, validating access to sensitive data without human intervention. Snowflake was promptly notified, patched the issue, and rotated their Jira access token, claiming no evidence of unauthorized data access was found.