PT-2026-41734 · Pypi · Amazon-Redshift-Python-Driver

Institute · Published 2026-05-18 · Updated 2026-05-29 · CVE-2026-8838

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions amazon-redshift-python-driver versions prior to 2.1.14

Description Unsafe use of Python's eval() function on data received from a server within the vector in() function allows a rogue server or man-in-the-middle actor to execute arbitrary code on the client.

Recommendations Upgrade to version 2.1.14.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-8838

GHSA-29H4-R29X-HCHV

Affected Products

Amazon-Redshift-Python-Driver

References · 11

• https://github.com/aws/amazon-redshift-python-driver/releases/tag/v2.1.14 · Patch
• https://aws.amazon.com/security/security-bulletins/2026-033-aws · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-8838 · Security Note
• https://osv.dev/vulnerability/GHSA-29h4-r29x-hchv · Vendor Advisory
• https://github.com/aws/amazon-redshift-python-driver · Note
• https://github.com/aws/amazon-redshift-python-driver/security/advisories/GHSA-29h4-r29x-hchv · Note
• https://twitter.com/CVEnew/status/2056670128390234421 · Twitter Post
• https://t.me/cveNotify/163931 · Telegram Post
• https://t.me/CVEtracker/54161 · Telegram Post
• https://twitter.com/ADKCyber/status/2056810222740554114 · Twitter Post
• https://twitter.com/infoflowcloud/status/2056671624531677267 · Twitter Post