nvd.nist.gov /vuln/detail/CVE-2026-8838

nvd.nist.gov • May 30, 2026

Unsafe use of Python's eval() on server-received data in the vector_in() function in amazon-redshift-python-driver before 2.1.14 allows a rogue server or man-in-the-middle actor to execute arbitrary code on the client. To remediate this issue, users should upgrade to version 2.1.14.

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address this page to [email protected] .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Code Injection Vulnerability in amazon-redshift-python-driver A code injection vulnerability has been identified in the amazon-redshift-python-driver, affecting versions 2.1.13 and earlier. This flaw allows a rogue server or man-in-the-middle to execute arbitrary code on the client. The vulnerability is due to insufficient validation of data received during query result processing. AWS has released version 2.1.14 to address this issue and recommends immediate upgrades. The vulnerability has been assigned CVE-2026-8838. Users of the affected driver should patch their systems promptly to mitigate risks. The issue was disclosed through a coordinated effort with researchers from the Institute of Information Engineering, Chinese Academy of Sciences. AWS has provided contact information for security inquiries. 2 sources 72

Extracted Entities

nvd.nist.gov /vuln/detail/CVE-2026-8838

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Domains (1)

Platforms (1)