AWS SDK for pandas (awswrangler) SQL Identifier Injection 3.5.2-3.17.0
CVE-2026-119301 Published on November 2, 2026
Improper neutralization of quoting syntax in Apache Iceberg SQL identifier generation in AWS SDK for pandas
Improper neutralization of quoting syntax in SQL identifier construction in the Apache Iceberg write component in AWS SDK for pandas (also published as awswrangler) 3.5.2 through 3.17.0 might allow an authenticated remote user with permission to modify AWS Glue Data Catalog metadata to read any table that a separate, more privileged principal can access and write to the table that principal is updating via a crafted column name.
To remediate this issue, users should upgrade to version 3.17.1 or later.
Vulnerability Analysis
CVE-2026-119301 can be exploited with network access, requires user interaction and a small amount of user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and a small impact on availability.
Weakness Types
Improper Neutralization of Quoting Syntax
Quotes injected into an application can be used to compromise a system. As data are parsed, an injected/absent/duplicate/malformed use of quotes may cause the process to take unexpected actions.
What is a SQL Injection Vulnerability?
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.
CVE-2026-119301 has been classified to as a SQL Injection vulnerability or weakness.
Products Associated with CVE-2026-119301
Want to know whenever a new CVE is published for Aws Sdk Pandas? stack.watch will email you.
Affected Versions
aws-sdk-pandas:- Version 3.5.2 and below 3.17.1 is affected.