What is CVE-2026-119301 in AWS SDK for pandas?
CVE-2026-119301 is a high-severity security flaw with a CVSS score of 7.9 that impacts specific versions of the AWS SDK for pandas. Similar to cases where other software components face critical flaws such as vulnerabilidad crítica en la librería zip, managing secure dependencies is paramount. This issue arises from improper neutralization of quoting syntax.
The flaw specifically exists within the Apache Iceberg write component of the library. When handling SQL identifiers, improper neutralization can lead to unexpected behaviors during metadata operations.
Who is affected by this vulnerability?
The vulnerability affects installations using AWS SDK for pandas (also published as awswrangler) from version 3.5.2 through 3.17.0. Applications utilizing the Apache Iceberg write feature within these version ranges are directly exposed.
An authenticated remote user who possesses permissions to modify AWS Glue Data Catalog metadata can exploit this. By utilizing a crafted column name, they might read any table that a separate, more privileged principal can access, and write to the table that principal is updating.
How do I protect my systems?
Mitigating this security advisory requires immediate action from administrators and developers maintaining affected data pipelines. Parallels can be drawn with remediation strategies seen in vulnerabilidad crítica de escalada de privilegios where immediate patches are required.
You should upgrade your environment to version 3.17.1 or later referencia técnica en github.com. You can verify additional guidance directly through referencia técnica en github.com or the official bulletin referencia técnica en aws.amazon.com.
- Check your current package version of awswrangler or aws-sdk-pandas.
- Run the package manager update command to fetch version 3.17.1 or later.
- Verify that the updated library is loaded correctly in your runtime environment.
pip install --upgrade awswrangler