CVE-2026-8838
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk53th percentile - higher than 53% of all known CVEs
Summary
In the amazon-redshift-python-driver before version 2.1.14, the vector_in() function uses unsafe eval() on server-received data. This allows a rogue server or man-in-the-middle attacker to execute arbitrary code on the client. To remediate, upgrade to version 2.1.14.
Risk Assessment
An attacker can remotely execute arbitrary code on the client machine connecting to Redshift, potentially leading to data theft or client compromise.
Recommendation
Update amazon-redshift-python-driver to version 2.1.14 or later.
Original NVD description (English source)
Unsafe use of Python's eval() on server-received data in the vector_in() function in amazon-redshift-python-driver before 2.1.14 allows a rogue server or man-in-the-middle actor to execute arbitrary code on the client. To remediate this issue, users should upgrade to version 2.1.14.