p PatchFirst

CVE-2026-8838

CVE-2026-8838 · Remote Code Execution via eval() Injection in amazon-redshift-python-driver

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Unsafe use of Python's eval() on server-received data in the vector_in() function in amazon-redshift-python-driver before 2.1.14 allows a rogue server or man-in-the-middle actor to execute arbitrary code on the client. To remediate this issue, users should upgrade to version 2.1.14.

CVSS 9.3 · Critical · EPSS 0.8% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • amazon redshift connector for python

    Versions
    • ≥ 0, ≤ 2.1.13: Affected (custom)

    No fix published

  • redshift-connector PyPI

    Versions
    • 2.0.384
    • 2.0.389
    • 2.0.393
    • 2.0.399
    • 2.0.405
    • 2.0.659
    • 2.0.711
    • 2.0.872
    • 2.0.873
    • 2.0.874
    • 2.0.875
    • 2.0.876
    • 2.0.877
    • 2.0.878
    • 2.0.879
    • 2.0.880
    • 2.0.881
    • 2.0.882
    • 2.0.883
    • 2.0.884
    • 2.0.885
    • 2.0.886
    • 2.0.887
    • 2.0.888
    • 2.0.889
    • 2.0.900
    • 2.0.901
    • 2.0.902
    • 2.0.903
    • 2.0.904
    • 2.0.905
    • 2.0.906
    • 2.0.907
    • 2.0.908
    • 2.0.909
    • 2.0.910
    • 2.0.911
    • 2.0.912
    • 2.0.913
    • 2.0.914
    • 2.0.915
    • 2.0.916
    • 2.0.917
    • 2.0.918
    • 2.1.0
    • 2.1.1
    • 2.1.10
    • 2.1.11
    • 2.1.12
    • 2.1.13
    • 2.1.2
    • 2.1.3
    • 2.1.4
    • 2.1.5
    • 2.1.6
    • 2.1.7
    • 2.1.8
    • 2.1.9
    Affected ranges
    • ECOSYSTEM: < 2.1.14

    Update to 2.1.14

Original sources

Check your server →